Always test your backups
By Ricardo
Story time
It was January 29th 2016. A huge, insanely strong storm hits Porto Alegre. By the sound of it, it was going to make a lot of destruction. Less than 5 minutes into it, I’ve lost my telephone line, 3 minutes or so later the power. Cellphone towers went down or got overloaded a few minutes later.
No power, no landlines and no mobile internet (2G worked mostly well though).
Turns out the extreme winds knocked down many trees, power lines and pretty much anything else outside. Such winds were caused by two small tornados that hit the center of the city (pretty much where I live).
I went outside after the storm stopped and looked, in the dark, for the damage (I’m that curious). I was carrying a big flashlight for that, of course. In the next day, I went out, just like everyone, to take a look at the damage and take photos.
Holy crap. That looks bad.
Oh well.
Anyway, after 41 hours without power, 5 without water and about 56 without telephone and internet, everything went back to normal. But that was only the weekend. On Monday I went to work as usual, since I assumed that the whole city had power already. Oh boy, I was so wrong…
Monday
Once at the office, I noticed that we didn’t have proper power: it wasn’t 0V, but it was way less than 127V. Some lights would still turn on, but powering a PC was pretty much impossible. The network was also unstable. Anything that required some current would drop the voltage too much at the point of turning off.
To cut the story short, I was “requested”1 to work on a laptop which still had battery. Fair enough. For that, I would need two things: a database to work with and my backups. The first one took me a while, since our backup server was down because someone took it out of UPS (why?!). But the second one wasn’t so easy.
First of all, I keep my work backups2 on a 3.5" HDD case with an old 500GB drive on it. This case requires external power, so with the power failing it wasn’t working that well. Once I got it running, there were two issues:
-
It’s a BitLocker-encrypted disk. This is the easy part, since I know my password, obviously. That’s fine.
-
The NTFS permissions are custom so that it only opens on my user on my computer.
The second issue is more complex than it looks like. Once you set that only your user can open a folder or a drive, you’re essentially locked out of it if the system or the user changes. Change any of them and you’ll get an access denied error, since the user’s SID will change.3 Ops.
There’s a way of fixing it. All you need to do is force the system to make your user the owner of the drive and then reset its permissions to normal. Ok, it’s a bit more painful than that, but that’s essentially what you would have to. There’s one single problem on this: you need to be an administrator on the new machine. And I was not.
What a mess. A mess that locked me out of my backups.
Well, shit.
Conclusion
Again: well, shit.
So turns out being too extreme with folder permissions ended up blocking myself from my backup data. I can open the drive only at work, on the same machine, with my own user, unless I fix the issue with an Administrator user. But that would take hours, which I didn’t have on a standard laptop’s battery. No I had no easy way of accessing my data and not really a proper Internet connection (or even a network, actually) to look it up online.
Do you know when people say that you should always try to recover from your backup to make sure it’s working as you wanted? That was the first time I had to recover on another machine, and nope, it’s not working.
So always test your backup, even more on a different system. It takes a few minutes, but it’s worth it. Trust me.
Good luck.
PS: I ended up going home that day, since we also lost water supply at work.
-
Yes, the quotes are necessary in this case. :-( ↩︎
-
Backups at home are a whole different story. I have bigger drives for that and I don’t really care for securing them, since most of the data is not that private. ↩︎
-
In theory, I guess you could transfer the SIDs? But I think that’s only valid for domains and it’s more like saying one SID means another and not really transfering them. ↩︎