Educause Security Discussion mailing list archives

Re: Discoverability of expired tapes?


From: Joel Rosenblatt <joel () COLUMBIA EDU>
Date: Wed, 6 Jan 2010 11:41:15 -0500

IANAL

In theory, if the data is available, you need to provide it, the question is - does it show up in your backup system as 
available, or are you taking
"extraordinary measures" to see that the data is there (similar to undeleting  the file system that has been just 
deleted, not wiped)

If you can just do a restore using the normal commands available from your backup system, then I would say you have to 
provide the data, if it's the second
scenario, then you need to go to your GC, explain the situation and do whatever they tell you to do :-)

My 2 cents .. in any case, I would talk to your GC

Joel Rosenblatt

Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel


--On Wednesday, January 06, 2010 8:31 AM -0800 Greg Francis <francis () GONZAGA EDU> wrote:


Hello,

I have a question for those out there that may have dealt with this issue.

We have set our tape backups for our Exchange system to expire after 14-days. We keep no archives. This not only saved 
us a significant number of tapes and
had negligible impact on our recoverability, but it also reduced our eDiscovery issues significantly. BTW, we don't  
have a mail archiving solution in place.

What I just discovered in our backup system is that, even though the backups are expiring, until the tapes themselves 
are reused, the backup is still listed.
The tapes are all marked as "expired" and are available for reuse but the actual session (we use HP Data Protector) 
doesn't purge from the backup software
until all of the tapes for the session are used. In reviewing this, I discovered that three backups over the 14-day 
expiration period still have all of the
tapes available so I could theoretically recover them if I had the need.

My question is this, since I can recover these backups, are they discoverable even though all of tapes are marked as 
expired?

BTW, I'm looking at ways to purge these sessions once they have expired but we're in a situation where we might not 
want to do that right now.

Thanks,
Greg


Greg Francis
Director, Central Computing and Network Support Services
Gonzaga University






Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel

Current thread: