Laptop Disaster Recovery

Waffle Background

This is what it's like getting Windows to play "nice" with Linux some times (and vice-versa)

And I don't mean the Linux sub-systems for Windows, but actual dual-boot scenarios where the Microsoft device is sulking a little.

I've been a Surface Pro user for some years and still haven't found anything that combines the flexible form factor & performance as well. I'm a little tempted by the Surface Book range but as I'm pretty tired of the limitations of Windows I'm still a little reluctant to shell out £3k+. The SP network adaptor is very limited so if you do work on network security you'll need that USB Alfa device. 

In my cynical way of thinking I've always thought these laptops were Microsoft's way of forcing the device manufacturers to get off their lazy backsides, spurring them to try something other than the clam shell form.

It's good to see HP and Lenovo making inroads to that effect, however none of the main device manufacturers seem to have come up with anything other than copies. Even now Microsoft seem to be the only vendor still pushing for innovation.

I won't dwell too much on Apple devices - they make great devices but terrible, bland software. However it is based on a variant of OpenBSD (albeit some time distant) and the hardware is fairly good.

The SP4 seems to have maxed out the potential and over the last ten years I've changed from a staunch Windows user & dev to multiplatform. I don't really have faith in Windows for anything other than Xbox, Netflix and Visio - everything else is generally better on Linux. They're both frustrating OS's at times but for altogether different reasons.

Of course the problem is that should you, for example, go on hols to Portugal and drop your SP on the hard stone floor, the screen might shatter and crack along it's entire ... er... surface? I bought my SP3 from John Lewis through my business but later found out that they don't have an instant replacement mechanism. You'll be without the laptop for up to 8 weeks whilst they review and - in all likelihood - replace your Surface. Microsoft are careful to tell you that if you have anything on your device when you pass it to them... it's as good as gone.

The only major problem I've seen with SP - and the one that's driven the need for this blog post - is that these form factors are even more sealed than the legacy clam-shell form. You just can't open them up and replace bits without some knowledge and a lot of faith in your skills.

Instead of JLP, I'd originally got my SP4 direct from the Microsoft store, and just logged in to my MS account to select the device for a support request gets the ball rolling. This cost to me £399 inc. VAT as this device was out-of-warranty. There were problems: the self-print return envelope didn't get sent, I had to find a UPS Collection point where there are seemingly none in my local area. Not earth-shatteringly problematic.

In fact the only delivery delays were at my end - my company uses a postal service to manage inbound mail and there was a complication with the replacement devices' onward travel.

Fresh new SP4 newly unpacked on arrival

Total time including cock-ups? About 3 weeks, would have been a little over 1 with smooth sailing.

Equipment Used

So as I mentioned I'm using a Surface Pro 4, which is dual booted using Ubuntu 16 over Jake Day's superb Linux Kernel build; and Windows 10 Pro.

If you're only working with Windows I'd really recommend using the Windows backup features as they will be far easier to manage. The complexities that follow are due to the dual-boot nature of my devices.

However if you're using another encryption solution (non-MS) and need to ensure Windows doesn't try to be too clever, I'd recommend using a more assured process like the one I'm about to describe.

I was lucky though - although the screen was busted the device actually worked. Mouse & keyboard or Type cover got me around the worst. If the screen is totalled, you can try using a docking station or the mini DisplayPort out to a separate monitor - just hope that you'd already enabled USB boot otherwise you won't be able to get into the UEFI config.

Because of this I've accumulated the following useful trinkets as time has passed:

• a 256Gb - 1Tb SDD - depending on compression and device disk size
• a USB 3.1 external SDD case / caddy
• a USB SD card caddy / reader + something like a 4Gb class 10 SD card; or
• a 4 GB USB data stick
• a USB hub
• a type-C to type-A USB cable for the SDD caddy (likely will be different depending on which caddy you choose)
• a large bag of patience or an appreciation of progress bars
• a spare laptop (if you need to work whilst your primary is in repair); or
• your desktop (if your SP4 screen is busted o
• Surface Type keyboard (best) or USB keyboard (make sure it works with Linux and Windows OotB)

USB SD card reader, SD card, USB hub, type-C cable and Win10 Pro on USB

I of course would like to point out that all software and hardware is fully licensed and legally purchased.

Because I do a lot of things with Raspberry Pi's I tend to have a number of SD cards around and a lack of USB sticks - the SP has an SD card slot and only one USB so you tend to adjust your thinking somewhat. Replace that SD card & reader with a USB stick as suits you.

Taking The Backups

All partitions except the original Windows 10 partition are encrypted, and there's nothing on the Win partitions that provides a poacher with anything useful, so I didn't encrypt the external drive first.

However if you're working on a mobile device without disk encryption - especially for work or where there's anything sensitive on it - you should really protect yourself. If your SP is shafted now though and you need to take a backup before sending it back to the shop, just encrypt the removable SDD.

You will need to ensure that the appropriate boot options are set in your UEFI config. I also disable secure boot as there's a number of security packages that don't work with it on Linux, and it doesn't provide a huge amount more than a deterrent on a Microsoft-made device.

Enable USB, disable PX network & IPv6, finally relock the configuration and ensure a UEFI config password is set 

Please note that all the commands from here on in are based on bash (Linux).

One SDD - I'm going to re-use this in my desktop at some point so went upmarket

I use the Inateck SDD cases - they work well, are robust and nicely designed

If you need to encrypt your external device due to the reasons I've mentioned above, and example would be:
sudo cryptsetup luksFormat --cipher serpent-xts-plain64 --hash whirlpool --key-size 256 --use-random /dev/sdd2

Where:

• use cryptsetup benchmark to list all the ciphers and hashes your machine supports
• I've selected serpent-xts as I don't entirely believe AES is best placed under guidance of NIST
• I've selected whirlpool as a hash algorithm simply to demonstrate you have the option
• /dev/sdd2 just happened to be the device name I was using 

You can add a key file if you like, but just remember you'll have to make that file available on the SD card on the live installer we'll be creating. It may not provide the security on the key file itself that we should employ - a decent horse battery staple will do. Grown-up explanation with big words here if you want it.

This is just one route as LUKS is common to a number of distros. Veracrypt and others are also excellent as well as x-platform. You'll just need to ensure the packages or executables are available in your live installation distro-of-choice.

You'll need another OS to boot into from a USB (or SD if you can make that work) device: I opted for Tails as Ubuntu 16 didn't live boot very well. Rather than tread old ground you can read up on that here.

USB hub holding the USB SD card reader with Tails on it; and the other cable goes to the portable SDD

Actually in that photo is a Surface Bluetooth Keyboard: great keyboard action and layout but needs a re-sync / pair when booting between OS's, and won't pair during boot for things like FDE password entry. Such a shame that it's basically only usable once you've booted into your OS. Avoid. The MS Sculpt Keyboard is USB-dongle and great to use. They've been practising making keyboards for thirty years so no matter what you think of their software they still make arguably the best finger peripherals.

Assuming you've now got Tails on a USB-able device and have prepped a partition on your USB SDD, plug it all in and boot into the Tails loader, making sure you've enabled root.

You can run the live installer with an encrypted file store, but you still need to change the defaults every boot

Once in, open up a root terminal and figure out what name Tails has given to your USB SDD. Among many ways of doing this you can try lsblk. In my case there was only the SP NVME device and the external SDD, so were both obviously distinct.

lsblk example output

You'll need to mount the SDD to allow you to to use dd to capture backups. Create a new folder with a mkdir /media/backup, mount your SDD with something like mount /dev/<name> /media/backup then CD into this folder.

You can run the following command for each partition you have, or just the whole device. I took backups of individual partitions "just in case" too.

WARNING: the dd command is sometimes referred to as the "disk destroyer". It doesn't validate much before executing your request so make absolutely sure you have the right sources and targets!

dd if=/dev/nvme0n1 bs=1024 conv=sync,noerror | gzip nvme0n1.gzip

You can use pipe view in there like this too:

dd if=/dev/nvme0n1 bs=1024 conv=sync,noerror | pv | gzip nvme0n1.gzip

That'll give you an indication of progress if you're so inclined. Once that's complete I'd recommend you wipe the disk with zeros and then randoms. There's documentation on the ArchLinux wiki so I won't duplicate here.

You'll need to do some maths to work out the block size of your actual disk and you don't need to do this if you were using FDE on all your partitions on this disk. I did it anyway as I was sending the device back to vendor and wanted to leave no trace of the types of opsec I employ.

You just don't know who's handling the device once it's returned to vendor.

Restoration

Again, ensure you enable root in the Tails boot config and apply whatever locals you need.

Because we're using a live installer to manage the disk restore, as we did in the backup, we can't guarantee that the device name will be the same. Use lsblk again and take a note of the correct device (use size or number of partitions if you're not sure).

open root terminal and script it like so:

# make a folder to neatly mount the external drive to
mkdir /media/restore
# mount the device again
mount /dev/<device> /media/restore
# change the working directory to reduce typing in the next command
cd /media/restore

I've already got my entire disk image gzipped, so I'm going to decompress that image and write it straight to the disk. I just don't care what the default SP4 install state is and I have a Win10 Pro USB key plus device license if anything goes wrong.

So I used:
gzip -dc nvme0n1.gzip | pv | dd of=/dev/nvme0n1 bs=4096 conv=sync,noerror

The first time I rebooted I nearly panicked... I got nasty error messages and returned to the UEFI config. Removing the boot order lock setting and allowing the device to get used to itself again sorted that out.

So happy to see the GRUB screen after restore. Now for all the updates since the backup was taken...

War Report

So for a device that cost roughly £2k and was out of warranty, and assuming I'd bought all those parts especially for the job; the total damage would have been around £700. As it was, I had all the parts already from various projects over the years.

If you have these devices in a corporate network I'd recommend taking a base image and ensuring your directory services force a network sync for all your user files. Anything else is the responsibility of the users and providing them a device with FDE enabled mitigates most other things. There's tools out there that do this across multiple OS's.

Costs to my company: £399 for the Microsoft part, around £250 for the SDD, and about £50 for the cables, cases and SD card. That's an expensive repair in comparison to some case opening and SDD swapping with a desktop or Dell laptop. It also cost me about an hour to sort out Tails, encrypt my drive and do the backup and about 30 mins restore.

If I'd had the base image and a replacement device that would figure to about 45 mins (including updates and file syncs post system restore), which isn't too bad along with a reduction in hardware & therefore cost.

Glad I'm operational again but this is the Achilles heel of the SP - and devices like it - cost of ownership is very high, as is maintenance and repair.

Took Some Finding

I've had some of my servers report that something has been running updates off-schedule, and it's taken me a good while to figure it out.

Some flavours of Debian - including Raspbian - have no unattended-upgrades service but do apply a cron job which triggers silent package updates.

I run all updates on a specific schedule so I can easily tell the difference in logs & reporting between a breach and an actual update so this isn't appropriate for our use at work. So the first advice I'd supply before using the configuration below is that ensure you have a valid and automated update mechanism to ensure your servers are kept up-to-date.

For example, I often use a custom script which not only does the update but then sends an encrypted message containing information about the update (or other types of jobs).

So with that in mind - and rather than altering package deployed cron scripts - I'd suggest changing (or creating) the /etc/apt/apt.conf.d/10periodic config to add or modify the Periodic apt setting to "disabled like this:

 APT::Periodic::Enable "0";

I suppose I could have put this on Stack Overflow but it's not really a question.

Disaster Recovery (Updated)

It had so much potential

Updated 12th March 2016. Newly added notes at the end of the post.

Back in 2014 I needed to choose a robust backup / DR solution that would help me prevent loss-of-hair & brown trouser moments - e.g. ransomware or user stupidity (my own mostly). All sorted and was fortunate enough to choose one that still covers my needs.

However since then I flirted with a couple of alternatives and ended up settling on a selection of cloudy storage options.

For the personal stuff I tend to use the big names (Google, Microsoft & Apple) which are linked into device accounts. These are really low-risk, low-value data items which business adversaries or other intruding agents [hackers] would find worthless.

However there's a lot of information which is business-focused - or that which is protected under one of my businesses ICO Data Controller registrations - which need more attention.

The reason I'm writing about it now is because since evaluating options I've moved away from Windows, so the requirements are now vastly different. So because I'm primarily focused on multi-platform solutions a lot of the offerings get defenestrated immediately.

Over the last few months I've been prodding and cajoling Tresorit to fix problems with their Linux client and have now officially given up. No responses from their support desk about quite critical issues in some time. One of the issues is that - whilst I had Visual Studio Code running, and doing some project work on a Python module - Tresorit started to sync one of the tresors which houses project work.

I watched in horror as the file list started reducing in number in VSC - it was like an unstoppable terror of code deletion. Anyone who's just discovered that code they've spent days or weeks applying themselves to is lost forever will know that feeling.

At first I hadn't made the connection between Tresorit and the file emigration but then I did a sudo find / -name <scriptname> only to see it right there. In a .tresorit/Trash/.. folder!!

Nope.

Not having that. Recovered all files - and a bunch of others I hadn't spotted were missing yet. Immediately closed Tresorit and fired up my previous DR solution. It took all night to get everything back up to sync and this morning to verify everything before ditching Tresorit completely.

Crisis averted. Still no response from Tresorit despite what now appears increasingly arrogant claims vs. it's competitors in the market. The Linux client came out of beta mid-2016 so should have been rigorously tested.

It's a real shame and I'm extremely disappointed - I really like that they have 2FA across a choice of mechanisms, and claim zero-knowledge across the entire platform (including via the web client - although this is unconfirmed). I'm not concerned with state actors as I've done nothing wrong but I need something that keeps competitors or their agents out - Tresorits Swiss & EU base fits this ideology too. I like the tresor mechanism of sharing and I'm now trying to frig something similar with my DR solution.

Perhaps their Windows and Mac clients are far better at this than their Linux offering so it might be unfair to tarnish their entire platform, but the lack of support (and wasted subscription fees) eroded my trust and after all, what is DR without faith?

Updates

I noticed that Tresorit tweeted a marketing message about feature enhancement, which - to me at least - seemed to confirm that they were essentially ignoring my bug notifications and support requests. I replied to the tweet and the account owner asked me for some details via DM.

After hearing nothing for a few weeks I prompted the Tresorit Twitter account again - this time they promised a response from their support & dev team. Five months to get a response from vendor on a critical issue (and only after complaining on social media).

The explanation given via email was more unsettling than the problem itself - they could not replicate the issue and that some fixes applied since November 2016 'may' have resolved some of the problems. What I take from that is that although none of the fixes were specifically aimed at resolving the problems I reported, they want me to see if they fix it.

In the same email the support member tried to tell me that I must have deleted the files from the tresor on a different machine, which triggered the removal on the machine in question. The problem with that is that I hadn't deleted any of the files on any other machine. The files in question were / are live code files related to an anti-spam module & reporting system I've been designing and writing - there's no way I would delete these files - I've put so much effort in. The other files I found after checking other tresors for mysteriously deleted files were legal documents I would never delete under any circumstances. I rechecked the other machine and I hadn't deleted either set of files there.

Tresorit's support suggested I check the logs - which I did - to see if any files were listed as deleted by user(s). They weren't. Essentially it was just the DR system wrongly flagging files as deleted and that removes all confidence I had using the platform in the first place.

I've since replicated what I liked about the tresor repository system within Spideroak One.

Overall, it's vindication that I made the right decision in abandoning Tresorit altogether, although I'm still wondering what was deleted that I haven't noticed yet.

Surface Pro 4 vs. Linux

Surface Pro 3 seemed to be stable, relatively efficient and a good mix for a dual boot laptop. Things were pretty good all round and Windows 8.1 Enterprise worked well on the touch-screen led device - probably not a popular statement but it was designed for Surface.

My own belief is that Microsoft didn't enter the laptop market to dominate it but to force the competition to get off their lazy backsides and start thinking again. We've had a stagnated market for over a decade and it's taken the software & keyboard kids to initiate change. Apple has had to improve it's hardware to compete with both Surface Pro & Book; HP and Lenovo have had to reconsider their clamshell laptop propositions too.

Moving beyond a simple single-OS laptop replacement a growing number of penguinistas have noticed the Surface and blogged about supporting it. Personally, I'd gotten to the point with Ubuntu 15.10 on SP3 where I was pretty much using it for everything work-wise - bar Visio and Excel situations, firmware updates for the Microsoft hardware and games or modern apps such as movie streaming or Kodi.
I don't use Windows for email and have my PGP keys available only on non-Windows OS's; all my remote work is done on servers via SSH and I lock drives up with a multi-platform encryption solution. Ubuntu handled all of that and seemed to get the most support for SP3 out of all the Debian-based distros.

Ubuntu didn't really do brilliantly with touch-screen but the stylus was a pretty good mouse replacement (assuming you don't need a right click...). The SP4 stylus was a big improvement on the SP3 variant - and didn't go to sleep at random whilst you were using it.

A big plus. And not generating a BSOD when you attempt to disable power management would have been a bigger plus. Although Windows 10 - in all it's greatness - decided to fail software licensing management services without any bidding on the replacement SP3, meaning I had to deploy W8.1Ent anyway...

Then the connector between the SP3 and the type cover stopped detecting anything - I have Type Cover 3 & 4 so tried both - and with John Lewis' support policies meaning a 3 week period without a laptop whilst they repair it; I was running out of options as I need a laptop to earn money / work on client site.

Perhaps rashly, I elected to buy a Surface Pro 4, take an image of my old SP3 and deploy straight onto the SP4.

I used dd more in the last month than I have in years

Of course - that would be too easy. Microsoft have revoked support for Skylake and a significant portion of hardware drivers for the SP4 from anything but Windows 10.

Dick move Microsoft.

I wasn't prepared to disable the driver signing checks and manually install 100+ drivers. Looking forward another 12 months I would not have thanked myself for the maintenance overhead.

After a lot of research and swearing I gave up. Reset the PC.

Plan B. Good thing I took a backup of the SP4 drive before I started eh? Redeploy the boot partition, the W10 partition and the W10 recovery image (a partition at the back of the drive) and run the re-deployment.

What's this? I can put Debian straight onto the SP4? Skip a few kernel versions and maybe get that Surface Pro driver support OotB? Why mess about with downstream distros like Ubuntu? A big thumbs up to Alexander Clouter who's been persistent enough to plug away at Debian 8 on the SP4.

All went fairly well until the reboot then I discovered a problem where putting the home mount point on a LUKS provided partition seemed to keep taking out the installer. Seemed to get confused, dismount the home partition cryptsetup preventing selection for home.

I tried putting all mount points into one partition and got Debian 8 loaded on it. But as soon as I got further into the configuration (around the kernel rebuild) things started going wrong. Despite long hours of research I couldn't get initramfs or hid_multitouch to deliver the right state prior to kernel build. Although I sorted out the sources I think it just needed someone with more linux experience to resolve the errors when it wandered off Alexanders plan.

More swearing. I used a couple of the old SP3 pens as darts on a dartboard and chucked some kittens in a wood chipper to make myself feel better.

At this point I had to carry the old SP3, a usb keyboard and the stylus on to client site and wasn't happy. I'd got plenty of other things to do (on top of the consultancy work during the day) and paperwork to sort out.

Right - so plan B stuffed. Plan C. This time I already had the partitions set up so just invoked the PC reset / W10 recovery process. W10 set up and updates re-installed I just grabbed the ISO for Ubuntu 16.04 Desktop and plodded through the deployment.

Same issue with the LUKS and separate home mount point - eventually gave up on the idea altogether and created a shared encrypted partition which is usable by W10 and Ubuntu, along with separate partitions for later use.

Thanks to Spideroak it was pretty easy to download and re-deploy all those custom .bashrc and .bash_alias type moments - and Evolution backups that I use to replicate my environment across machines.

Finally Operational

Windows 10 is an utter disappointment. If I'd never seen Windows 8 I would have loved it as it's a great step forward from Windows 7. It makes even more sense when you use it on a touch screen device like a Surface and with the stylus & OneNote the whole thing takes on new meanings in meetings.

However my faith in Windows 10 is gone - 8.1 was a pinnacle in user experience and there's a lot of it's logical workflows that I hope will one day be amalgamated into 10; e.g. VPN - the charms allowed me to select a configured VPN adapter whereas in the W10 right-side menu it opens the control panel VPN settings page - a wholly unnecessary screen jump for an "on/off" operation. For now though it's a step backwards.

W10 also has a recently introduced "undocumented feature" which has touch-screen and stylus stop responding seemingly at random. I'm pretty much steering clear but OneNote, Excel and Visio keep that productivity link - there's nothing that comes close on Linux unfortunately. The majority of my work is done in Linux - Architool, LibreOffice, Evolution and Office365 Enterprise (depending on the client).

Game streaming from an Xbox One though is a huge plus for W10 and the new processor & cooling fan doesn't sound like a helicopter on take-off when the slightest CPU utilisation spike hits. Did I mention that I like it that the SP4 pen doesn't fall asleep at random whilst you're using it?

Security Concerns

After all of the recent nag-malware, privacy issues and Microsoft’s collaboration with various data collection schemes I'm left only with concern that my security and data investigation work would potentially be compromised by continuing to use the ecosystem in any great way.

I've already encountered a swathe of spear phishing attempts using email addresses only available to the subjects of spam hunts or AV firms (more of that another time) and not reading my emails on Windows is good way to cut out 99% of that threat vector. The rest I can deal with via opsec & security solutions on Linux.

Hindsight is a wonderful thing and what I should have done was buy a replacement [new] SP3 i7 and just redeployed the machine image from old to new. Maybe there would have been some software licensing tied to hardware ID's - or perhaps a re-sign of secure boot certificates. But nothing as relentless as the SP4 option or as expensive. It has not proved value for money and I'll not be buying an SP5 unless it's device vendors provide drivers for the open source community.

Auto-Archiving IMAP in Outlook

It seems like I'm not alone in initially being surprised that IMAP accounts cannot be archived in Outlook.

After spending some time poking around forums, Q&A sites and product support pages it's as simple as IMAP and archiving are mutually exclusive. I thought I'd put a concept forward for anyone out there who needs both the convenience of externally hosted IMAP functionality as well as the maildrop & delivery capability provided by the POP3 system.

A typical example here for me is wanting to access the same email account across multiple devices, get alerts on incoming messages on those devices, and be able to reply should I need to.

I also want to be able to take an archive of older emails (receipts, legal conversations, audit items, records of business and conversations, etc) and store separately for a given period too.

So in order to get around this I use IMAP almost everywhere but then on one (perhaps two locations) I'll connect via POP3 over Outlook - use whatever email client you wish - and use the auto-archive facilities to create email archive files.

Application and Service Relationship

These files (PST) can then be added to an offsite backup. An IMAP account in Outlook will use an OST file to cache mail items and headers but if its deleted or lost your IMAP account is unaffected.

Archive and Artefact Relationships
 

Simple Backup Follow up: Part 2

Ok so having sifted through roadmap candidates I was left with Carbonite, SpiderOak and Backblaze.

As I mentioned in the first part of this piece I've got some very specific [picky] drivers and requirements for this solution.

Carbonite seemed pretty good overall but the price is an issue. For £34 a year (or thereabouts depending on the forex rate) you get to backup only one device. Even the next package up at around £60 a year is restricted to one device.

However for that you get unlimited space on your single Windows or Mac machine. It's not bad but I'm aiming for something that isn't as restrictive to cover my secondary drivers and requirements. To do that I'd have to take one of the Pro Plans, which start at £162 per year. That covers an unlimited number of devices but is then restricted to 250Gb.

It's an option but I'm discounting it for now as I'm going for something cheaper - perhaps even considering Carbonite alongside Datto for an enterprise-level candidate. My concern there is for non-US customers as they have stateside support only according to their website.

So down to two, both of whom have trials available.

I started with Backblaze as it seemed to cover all aspects. The review from the original cloud storage reviews list stated that Backblaze doesn't have a single-point encryption key to match some of the other products but I think the vendor has added the feature since that review.

All fine - good price: Either £3 per month for an essentially unlimited storage quantity, or £9 for the year. I actually thought I need look no further - and for most people this will probably do what you need it to do with minimum hassle. It's pretty easy to use ... but the problem is that I couldn't use it the same way I could with Mozy Pro and define specific backup sets of files and folders. I need a selective DR option and this would take too much time to configure.

With Backblaze I found it would back up all drives, but then allow me to isolate exceptions to the rule to exclude from future backups / delta chains.

Inverse selection....Choose everything then remove everything you don't want

 If it wasn't for that small issue I would have signed up there and then. If you don't have such restrictive requirements and are looking for something safe and cheap you may want to take a look at the options this vendor provides.

My last option was actually added after further research whilst trialling Backblaze, and does exactly what it says on the tin (what I'd call "a Ronseal job").

Whilst the free 2Gb, unlimited devices, hive capable, secure and fast capabilities seem great;  A word of caution: The two-factor authentication is limited as this is a US-focused product too - you cannot use the two-factor authentication unless you have a Canadian or US mobile number. I can get around the problem as I have infrastructure and phone numbers in the states but anyone solely based in Europe would need to review and balance capability over protection.

The vendors engaging the wider FOSS community with outer shell tools and libraries from their product. There's a description of the encryption and hashing algorithms implemented within the web-gumpff pages if you want to read it in detail. Its impossible to tell exactly how they're managing the information protection aspect of the implementation from the sales page but use of CFB is interesting. Works for me.

The only problem I have with that will be future release of open-source libraries used by their main products. Open-source is great but without organisation-level QA of each delta there's a risk of insecurity - lets hope that changes with the major corporate push on critical open source projects from earlier this year. We'll see where that goes but for now I'm going to shortlist SpiderOak.

I've read a few reviews that state that the UI isn't as intuitive; or that its quite complicated - I think thats probably relative. Its more complicated that Backblaze, but probably about the same as MozyPro. The UI is consistent on the Debian package as well so I'll give it a thumbs up.

I like that SpiderOak has endpoint installers for my favourite OS across Windows, Debian-based and Android...but no Windows Phone. We'll see how that goes for now as its not a critical requirement. [Update: WP doesn't need it due to the direct integration with OneDrive]

Whilst chipping away at this article I've been running SpiderOak for a day or so on a selected backup set. I had some problems with the SSL scanner within one of my security suites initially, but have since resolved that issue.

The final candidate, operational across numerous devices.

I ran some tests on a couple of other devices and virtual machines. Windows Server 2012 R2, Kali, Windows 7, Debian and a Mac all worked perfectly well. Time will tell but for now that's all boxes checked. I didn't get round to checking how well it works on the Nexus 7 but there's nothing of value on there anyway. We don't have any overpriced paperweights in this house [c.f. iPad].

SipderOak doesn't store plain text backups, encrypts before transfer and encrypts the transport so prevents easy acquisition of my device files and data.

TL;DR

Overall this is the viable candidate for me, and in summary (comparing it against my original key drivers) I can sync and schedule backups separately, or link the events together - with a per-machine sync schedule. There's a zero-visibility policy meaning only I can unlock the secured backup sets. I can have 2Gb storage free forever - Although I've now signed up to the annual 100Gb package for £60. Its more than I was paying for Mozy Pro but I get more for my money, better support availability and unlimited device capability (including mobile and virtual). I can pick and choose where to restore specific files from any device in my list.

All the candidates I looked at were good products but this one suited my needs better than the rest. I'd be really interested to hear other opinions.

Simple Backup Follow up: Part 1

Having ditched Mozy Pro after trials and tribulations described in an earlier post, I've started looking at alternatives.

I've had no response from MBW or Mozy regarding my password reset or product code requests so couldn't get any further with the uninstall / reinstall process. Needless to say that I haven't got time to spare dealing with the problem, so am looking at other solutions.

Anyone facing a similar choice of offsite backup solutions may find the results useful, but I found this comparison quite a useful starting point. Personally, I'm always a little suspicious of who paid for advertised reviews and which reviews are genuine; so found this list that contained a wide range of solutions.

From my perspective, the term "cloud" is a sales buzzword for architecture that has been in existence for at least a decade. "Cloud", "cloud hybrid", "private cloud" essentially just means "hosted" - With a combination of outsourced hosting or private / internal hosting infrastructure.

Moving past this, the objective of the exercise is to find an offsite / cloud backup solution for personal use - perhaps even a vendor that provides appropriate personal and enterprise-grade solutions. Obviously this is a very specific set of requirements, and yours will be different.

I'm aiming for the following drivers in order:

1. Ability to synchronise and schedule backups, potentially even machine restores
2. Price
3. Security (I'd like a secured backup that only the key-holder can open)
4. Capacity

Optionally, some secondary drivers would be nice:

1. Capable of backing up specific folders / files from a number of devices or VM's
2. Capable of restoring specific files to a device of my choosing

So where to start? Well Mozy Pro is discounted immediately. Whilst it seems to cover the main drivers it seems to miss out on the secondary drivers. Also my own experience has been tainted by the difficulty in solving a problem originally reported in 2010. If I had problems with Windows 8.1 Enterprise I'm not prepared to wait it out or see what happens with Windows 9 upgrades.

After doing some research I'm going to cut the list down to 2 candidates, although I focused on the following roadmap candidates to begin with:

• Carbonite
• Backblaze
• Datto
• OneDrive (Sky Drive)
• SpiderOak

For me, the whole OneDrive / Google Drive / Dropbox mechanism is great for a specific purpose - storing a bunch of files and folders online (or "in the cloud" if you must), and sharing across devices. We have a large proportion of Microsoft devices in our household, along with an iPhone, a few Linux boxes and some other kit I use in my sandbox.

OneDrive is great for allowing the share of files I've acquired on a PC to a sandbox machine on a different VLAN. Its also perfect for being able to capture, modify sales documents written in MS office on Surface Pro, desktops and Windows Phones.

However I've discounted this type of technology almost straight away because I'm looking for a dedicated backup & disaster recovery option for some very specific file sets. Windows 8/8.1 already takes care of things like apps and settings. I've also discounted them because it would be conceivable that MicroGooHoople^TM could allow access (by subpoena, for example) to those backups - don't forget that everything is based in the US your data is liable to US law.

Obviously that last statement is really within tin-foil hat territory :)

I'm also eliminating Datto as it's clearly an enterprise-grade solution (and has no prices on the website!). EtE encryption, Atom 2.4 Ghz 8 core processors on the backup servers, backup chain recovery, bare metal restores, etc.

In part 2 of this post I'll look at the remaining roadmap candidates:

• Carbonite
• Backblaze
• SpiderOak

 So far I'm also seeing encouraging alternatives for all the MBW features I use and will speak to one of the vendors to take the services outside of the MBW package. Great when its all working but appalling when you need assistance.

Simple Backup

I've just returned from a family holiday in Italy to find that my offsite backup for non-essential files still isn't working. I thought I'd leave it after making some system changes and seeing if it resolved itself.

It's pretty simple - All it needs to do is take deltas of selected folders and ensure the latest changes are kept securely offsite. If a PC goes up in flames then I can just restore the important photo albums, etc without much hassle. For more important or critical backups I use other corporate solutions but for the low sensitivity stuff I use MozyPro.

So ever since I restocked a PC with a new SSD and rebuilt with Windows 8 Enterprise I've been having issues - not with the hardware or operating system - but with the backup software. It's not so much that the software is a problem but the support and offered solutions that I have a problem with (or perhaps more that people are being given such terrible advice).

So it started with an innocuous error message "FilesystemError4".... Nicely labelled but with no real indication of what it means in any of the application event items. It does, however, link through to the equally useless expansion of the error category:

So I had a look around, ran some check disks, used SanDisks own disk evaluation tools for the Extreme Pro....no hardware issues at all.

As there was little or no explanation from the application I tried a few searches and quickly discovered this was a reported issue back in 2010 - apparently with no resolution. People were being told to get a replacement hard drive from original vendors, run check disks, restart computers....For some it appears that netsh worked - Mozy actually suggested that people use the legacy version of their software to resolve the issue instead of attempting to diagnose the faults.

So I clicked the Support link on the application settings page and was taken straight to the MyBusinessWorks page....with no hint of a support link. I tried the chat window only to be told by "James" that I had to contact MBW directly by phone on an expensive non-geographic number.....Not impressed at all. I even asked him for a geographic number to use instead but - either through ignorance or belligerence - he told me that there wasn't an alternative and that I could ask a support representative to call me back once I got through to the support desk.

Absolutely unacceptable!!! Say No To 0870 to the rescue - helped me translate 0845 608 0280 into 020 7253 1649: If anyone needs it, this gets you through to the parent company automated switchboard; select option 2 for MBW support. Good thing I'd not called the 0845 number as I hung up after being sat on hold for over ten minutes.

The fact I'm paying for this service makes me so much happier. Its good to see such bright and enthusiastic direct routes to problem resolution.

Bear in mind I've already bought the service (MBW) and the system (MozyPro) but am unable to raise a support ticket with Mozy, EMC or Decho because I have an indirect license. Awesome.

I'm now working my way through error log messages from the text log of the application. So far I've needed to do the following:

1. Create a new user with specific permissions on the PC
2. Assign the new user rights to log on as a service on the PC
3. Assign this new user logon to the Mozy service
4. Enable read value / set value permissions to the HKEY_LOCAL_MACHINE\SOFTWARE\MyBusinessWorks\Online Data Backup\scheduling key

Its now getting further that the initial failure on backup start but it shows how inappropriate the error message is - a registry key read permission error designates a FilesystemError4. It looks like another failure during the actual backup relating to HTTPS chunked stream reads is failing, but then its reverting to the registry permission error. Will update the post when I have more but I think I'll be replacing Mozy Pro with a competitor very soon.

Update (12th August)

I'm going to give Mozy / Decho a 24 window to send the password reset request I made earlier, if that isn't sorted I'll wash my hands of it and go elsewhere. My only questions is why is something so simple so painful?

Final Update (14th August)

Still no word from the vendor. I'll post my reviews of alternatives in a later post this evening.