Snapback Exact from Datarrest

1
Snapback Exact from Datarrest

• Doug Wampler
• CECS 694 - Computer Forensics
• Fall 2005

2
Overview

• Server based backup program featuring open file
  management, remote administration, and backup
  scheduling.
• Copies an actual byte-by-byte image to tape while
  backup is running and files are open and being
  modified.
• Tape can be mounted as read-only hard drive by
  server.

3
Overview

• Suitable for small and medium networks.
• Recovery floppy, backup tape and single keystroke
  for disaster recovery

4
True Image Backup

• Backup/restore windows servers
• Databases may be in use
• No backup window - backup anytime
• Live user backup with no downtime
• Lightning fast speed
• OS restores exactly as it was
• Runs at machine level, independent of OS, runs at
  max speed of slowest device

5
Open Transaction Manager

• Allows backups to happen with open files such as
  databases, etc.
• Disappearing backup window
• No performance degradation
• No need for third party products

6
TapeDisk

• Makes a tape drive look like a read-only volume
  on the network
• Users can retrieve their own files this way using
  standard tools
• Automounts at end of backup process

7
Media Independence

• If drive types are identical, no problem
• If drive types are different, Snapback
  parameterizes them to make it work

8
Conclusions

• Good, but Windows-only tool for small/medium
  sized networks
• Could be useful for forensic imaging as well as
  normal backups
• Forensically valuable because of byte-by-byte
  copying ability

9
References

• DatArrest Website, http//www.datarrest.com/, 23
  October 2005.