The eMag Link Monthly Articles
June Edition
View previous articles
Ensure the Integrity and Availability of Your Data Part Three
Why Non-Native Data Restoration is Crucial to E-discovery*
Ensure the Integrity and Availability of Your Data Part Three
This is the third part in a series of 4 editorials that aims to look at the need to ensure the integrity and availability of data stored on tape within YOUR organization. Each part will take an in-depth look at the products, processes and services that are available to you to help ensure data integrity, reduce risk, improve performance and ultimately lower your cost of ownership.
While it is generally understood that investing in a hi-tech storage infrastructure is half of the battle; the way in which the information is then managed throughout its lifecycle remains the crucial factor if it is to ever be retrieved. The implementation of corporate governance and compliance policies and procedures requires organizations to look at the entire process:
- From the quality of the media in the first instance to the conditions in which it is stored
- From the policy to which it is backed up and then archived to the measures that are in place to ensure business continuity and third party neutrality should the data need to be extracted and presented in court.
This series of editorials will be broken down into the following sections:
- The legislative environment: internal and regulatory compliance - what are the challenges facing organizations today?
- The proactive approach to media management: defined product selection, sample archival testing, library audits, environmental audits, chip scanning and tape management through MM/TMS.
- The reactive approach to media management: data recovery, tape analysis/technical support, data conversion/migration, legal restores & file restoration.
- eDiscovery - why would my organization need a third party organization?
Part 3: The reactive approach to media management: data recovery, tape analysis/technical support, data conversion/migration, legal restores & non-native restoration.
Today's successful organizations are finding it increasingly difficult to keep up with the demands placed on them from internal and regulatory compliance and are often unsure what areas need to be prioritized. While a proactive approach to media management will help to ensure data integrity and minimize risk, if data needs to be extracted to support a disclosure order, timeframes quickly become important. The ability to restore data non-natively is the skill that has given eMag the competitive advantage as timescales for data production have become a real headache for IT departments across the developed world. By working with eMag, when the data needs to be restored for legal purposes, your organization can be safe in the knowledge that you have a procedure in place that will safeguard the intellectual property of your organization.
By working with eMag, your organization can be safe in the knowledge that if it's possible - we can help. Using a team of experts with over 40 years experience, our data recovery service provides for the recovery of data from physically damaged or logically corrupt tape media. It also provides data recovery for tapes that have not been physically damaged, yet the data is still unreadable. Our capabilities in this area are unsurpassed, however there are instances where the data is unrecoverable - it is for this reason that a proactive approach to media management is preferable to ensure availability under any circumstance.
When technical issues arise, in non-urgent situations we are able to provide read testing at one of our service centers and if necessary further analysis at the lab which in the majority of cases leads to recommendations for corrective action. If the issues are of an urgent nature we provide an engineer on-site to support the media and back up operation as part of the overall back up cycle with fault diagnosis and report.
Should you need to read data from a format that you no longer support, our in-house data conversion capabilities ensure that you are not left with islands of unreadable information. Not only do we boast 6 service centers worldwide with a vast IT infrastructure to assist with more complicated requirements; we have developed an in-house software tool that allows data to be read non-natively, thus enabling conversion to a presentable format.
To learn more about any of the topics discussed in this newsletter, please contact us today. Next months editorial will look in depth at the eDiscovery process and the extraction of targeted data to support a disclosure order.
Why Non-Native Data Restoration is Crucial to E-discovery*
The following articlen was written by eMag and appeared in the May Edition of Digital Discovery & e-Evidence.*
As the technology supporting electronic discovery continues to advance, an increasing amount of attention is being paid to non-native data restoration. While this approach to data restoration is often considered intimidating, it is founded on principals that are actually easy to grasp and well within the reach of most professionals in the field, regardless of technical prowess.
Storing records and other forms of data has always been a space- and resource-consuming task. As business evolved into the computer era, these demands increased. Storage became more expensive as early generations of hard drive disks held only limited amounts of data and memory was at a premium. To meet these demands, many companies moved their older data onto other resources - from "high cost" and "high demand" storage to less costly storage like computer tape.
Years later, as the volume of data continues to grow - storage requirements are doubling each year - tape remains a viable storage medium and promises to be just as valuable in the foreseeable future. Since it is undoubtedly here to stay, it's beneficial to understand how computer tape developed as a critical data storage medium and why non-native data restoration is the key to meeting this challenge from an electronic discovery perspective.
Generations of computer tapes
Computer tape is very similar to videotape. In its most common form, computer tape is essentially a Mylar or plastic base that is bonded to a metallic surface that can be manipulated to store either a "one" or a "zero," otherwise known as binary data. The "one" is all that is stored as a magnetic pulse and if the "one" is missing, it is assumed to be a "zero." The method used to make tape has become sophisticated and complicated in recent years, but its role is the same - accurate, durable data storage. In fact, modern formats like S-DLT and LTO claim a shelf life of 30 years. Computer tape is available in hundreds of shapes and sizes, and ranges in capacity from a few megabytes (MB) to more than one terabyte (TB) per unit.
In addition to sharing physical characteristics, computer tape and videotape share some common problems as well. Both can physically break, decay, pick up and deposit dirt, or become corrupted. Both can also become "anonymous." If the external label identifying contents is missing, the owner no longer knows what is contained on the tape. Computer tape and videotape will also become damaged if the temperature changes, sometimes to the point where the data can no longer be read.
Just as VCRs have used 4mm, 8mm, super 8mm, Betamax, VHS, D2, D3 and other technologies over the years, computer tape technology has also evolved. The industry now has more than 300 distinct hardware variations for formats such as QIC, DLT, LTO, AIT, 4mm and 8mm.
The "language" of data restoration
The tape itself is the carrier of the information or data. The data is written to the tape in what has become known as a "format." Tape formats are similar to spoken and written languages, which evolve with time. Students studying the works of Chaucer, the 12th century father of English literature, would be reading his "native" English. Yet this version (or "release level") of English is old and no longer understandable by the current users of this language. This is also the case with tape backup formats - old versions or releases are no longer understood by the newer versions of a vendor's software. As a result, data tapes containing abandoned and obsolete formats are considered, by many corporate and legal professionals, inaccessible.
That is not the case, however. When linguists need to understand a dead language - Latin, for instance - or a dialect they are not familiar with, they seek out other scholars to assist them in translation. While these colleagues are not native speakers of the alien language, they have either decoded it or been taught how to process it.
Likewise, software has been written that can read older computer tape formats and restore these formats non-natively - or, to put it another way, the software restores the data outside of its original and now lost "native" format. Just as scholars do not have to go back to Roman times to understand Latin, modern data restoration experts do not have to re-create the original tape back-up environment to read tapes.
Matching tapes to hardware and software
The first challenge in any non-native data restoration project is matching the physical tape to the correct tape drive hardware. Electronic discovery experts must be proficient in identifying the proper generation of tape drive. Additionally, hardware must be in working order and functioning in such a way that its internal operating system is able to interpret the raw data pulses that exist on the physical tape media. This is a challenge for formats like QIC (quarter-inch cartridge), where more than 120 distinct variations exist.
The challenge for non-native restoration vendors, tasked with recovering data from the last decade or two, is maintaining a working inventory of older tape drives. When these units eventually wear out, spare parts are nearly impossible to find. The best vendors keep a number of these older drives on hand.
Writing the software to gain access to all varieties of tapes also takes talent and hard work. Experts like those at eMag Solutions (Atlanta, Ga.) must first have the right hardware to read the tapes and then must be able to deduce the data structure within the information extracted from these tapes. The key to unraveling the archived data is remembering that information is stored in a manner that resembles the originating computer and software. The goal for a back-up system, after all, is that it should be able to reproduce the original information if necessary.
The meta-data "roadmap"
Additionally, the back-up medium will contain triggers to alert the originating software about where the data is to be restored and what it is going to be called. This identifying "data about data" is known as meta-data. Therefore, when reading a tape, the non-native restoration software looks first for information about how the tape was created (the software release, the server name, the back-up date, etc) and then searches the directory and file structures.
Some formats have this catalog at the beginning of the tape, while others carry the information at the end. Some formats provide no description of what they are, while others offer details about the whos, whys, whens and whats on the tape. Some formats back up the entire file, while others simply save changes to the document (e.g., "dog" was changed to "cat" at byte offset 23345). The latter approach greatly reduces the time it took for the original document to be backed up, but it makes data recovery more challenging since each tape containing these incremental changes needs to be restored in the correct sequence to rebuild the document.
As noted previously, tape can decay, be damaged or degrade in other ways that affect access. The best non-native restoration software recognizes this fact-of-tape-life and understands how to handle this situation if it is encountered. This type of software can step over the damaged sections of tape and keep reading "junk data" until it encounters the next unblemished segment of meta-data. A portion of what is restored from the "junk" might be forensically salvageable and of use, even though other parts are lost. Typically, this type of recovery can rarely be accomplished with native applications, thereby making non-native restoration particularly valuable in areas like disaster recovery and data conversion.
Another interesting aspect of non-native restoration is its ability to restore the data in a manner that conforms to forensic requirements. These requirements state that the data be restored with the original date and time stamps it exhibited when it was backed up. This is vital for maintaining true audit accountability that demonstrates who had access to which information during what period of time. To add further value, non-native restoration allows these files to be restored in a way that allows verification that what was read from the back-up tape is truly what was originally written to the disk, and that no modification took place along the restoration chain.
Computer tapes will continue to be the method of choice for data storage because they offer affordable, convenient, long-term storage that can be easily transported to off-site repositories. As such, they can save companies in times of disaster - and plague them when asked to produce data they had hoped would be forgotten. A non-native approach expands the possibility for restoration in both instances, granting access to data that may not have been obtainable in the recent past. Because of the far-reaching implications of superior restoration, non-native restoration software is fast becoming recognized as the gold standard in electronic discovery.
* Reprinted with permission from Digital Discovery & e-Evidence, Volume 5, Number 5, pages 11-12, published by Pike and Fischer. Copyright 2005 by IOMA, Inc. For more information on Digital Discovery & e-Evidence, call 1-800-255-8131 ext 248 or visit www.pf.ddee.
Product and company names mentioned on this web
page may be trademarks or registered trademarks of their perspective
companies and are hereby acknowledged.
This article may be
re-published as long as the following resource box is included at
the end of the article and as long as you link to the email address
and the URL mentioned in the resource box:
Article by eMag Solutions. For more articles on eDiscovery and Data Restoration, subscribe to our e-mail Newsletter by sending a blank email to newsletter@emaglink.com or by going to http://www.emaglink.com.