How to recover Backup Exec Server for Offsite Encrypted Tape Restore

[Windmiller_2]

With hurricane Irene on it's way I am trying to quickly put together the basics steps and data to be able to restore encrypted tapes offsite.

After a little searching these are the items I believe are needed but read a couple of threads that mention  needing the \Data and \Catalog folders.

https://www-secure.symantec.com/connect/forums/how-restore-backup-exec-server

Any recommended guides out there? Running 12.5.

Required Items

-Encryption key passphrase

-Backup of BE Database

-12.5 Installation software

[CraigV]

...without your Catalogs folders you will need to recatalog every tape you have in your secondary site. Depending on what type of tape and how much data is on them, this might take a while...

So include the Catalogs folder in that.

The rest looks OK. If you don't get a copy of the BEDB itself, BE dumps the database every night into a .bak file. THis will be enough if you don't have the SQL agent to backup the DB directly.

The rest looks OK.

Thanks!

[Ken_Putnam]

If you want to avoid having to re-catalog any tapes you want to restore from, you can also grab a copy of the \Catalogs folder

Just make sure the copy is from after your last production or special backup has completed

[Windmiller_2]

Thanks for the reply guys!

So should be able to perform the following on a remote server, does it have to be the same OS? As long as it's an OS supported by BE 12.5.

-Install 12.5 and updates.

-Restore BEDB

-Overwrite Catalogs folder on new server with backed up copy

-attach tape library

-restore *might need encryption passphrase.

[CraigV]

Well, ideally yes. But the Symantec TN below is definitely well worth a read in your situation, especially if you intend to move to a different OS but keep the same server name...

http://www.symantec.com/business/support/index?page=content&id=TECH67768

If you DON'T want to keep the same server name, then the TN above addresses that too...

[Colin_Weaver · Accepted solution]

As you are using Encryption - yes follow all the take copies of the bedb and data and catalogs folders as already discussed

However I would also recommend

- Consider copying the above items without encryption (thus not needing an encryption key that you might have lost to recover this information, obviously there are then security concerns about whether you store this copy with your encrypted data media or somewhere else)

- That you still have a manual document stored somewhere containing the passphases you have used for encryption (obviously this needs to be in a very secure location and prefarably not stored with your encrypted data media either)

- Consider not restricting the encryption keys within Backup Exec (make them common) The reason for this needs a bit more thought, if they are restricted then they are linked to the login account of the user that created them and other individuals with the correct access levels. If they are common anyone with access to the BE console can use them - think about what the effect might be if you have to build an emergency media server in a different domain (or a workgroup) and then recover the bedatabase into this when the security accounts related to the restricted key are not present. Note this won't be an issue if you recreate the keys from the passphrases