Last resort access to backups stored in vaults
Last resort access to backups is disclosed. An encrypted backup associated with a first system or vault is stored in the backup associated with another system. If a key needed to decrypt a backup in the first vault is unavailable, an encrypted copy of a backup in the second vault may be used for the recovery operation. Incremental backups from the first and/or second vault, which may be difference incremental backups and may be unencrypted, may be used in the recovery operation.
1. A method comprising:
initiating a recovery operation to recover a production system;
identifying a point in time for the recovery operation, wherein the point in time is associated with an initial backup stored in a first vault associated with the production system;
determining that a first key needed to decrypt the initial backup in the first vault is unavailable;
identifying a starting backup in a second vault associated with the production system;
identifying a second bridge backup stored in the second vault that is after the starting backup in the second vault;
recovering the production system up to the second bridge backup using the starting backup and the second bridge backup in the second vault; and
continuing to recover the production system from a first bridge backup stored in the first vault to an incremental backup in the first vault corresponding to the point in time,
wherein the first bridge backup and the second bridge backup share a common point in time, the starting backup has a point in time prior to the point in time of the first and second bridge backups, and the incremental backup has a point in time after the point in time of the first and second bridge backups.
2. The method of claim 1 , wherein the point in time for the recovery operation is associated with the initial backup and/or one or more incremental backups.
3. The method of claim 2 , wherein the one or more incremental backups stored in the first vault are unencrypted.
4. The method of claim 3 , wherein each of the one or more incremental backups is a difference incremental backup and wherein the initial backup and the starting backup are full backups.
5. The method of claim 3 , wherein the second bridge backup stored in the second vault corresponds to a same point in time as the first bridge backup stored in the first vault.
6. The method of claim 1 , wherein the bridge backups include one or more of difference backups and/or full backups.
7. The method of claim 1 , wherein the first vault is connected via an air gap to a backup appliance that generates backups of the production system.
8. The method of claim 1 , wherein the first vault comprises a backup storage system.
9. The method of claim 2 , further comprising recovering the backup using the starting backup from the second vault and incremental backups from the first vault and/or the second vault, wherein the starting backup is a full snapshot and wherein the one or more incremental backups are incremental snapshots.
10. The method of claim 9 , wherein a second key is known to the second vault.
11. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
initiating a recovery operation to recover a production system;
identifying a point in time for the recovery operation, wherein the point in time is associated with an initial backup stored in a first vault associated with the production system;
determining that a first key needed to decrypt the initial backup in the first vault is unavailable;
identifying a starting backup in a second vault associated with the production system;
identifying a second bridge backup stored in the second vault that is after the starting backup in the second vault;
recovering the production system up to the second bridge backup using the starting backup and the second bridge backup in the second vault; and
continuing to recover the production system from a first bridge backup stored in the first vault to an incremental backup in the first vault corresponding to the point in time,
wherein the first bridge backup and the second bridge backup share a common point in time, the starting backup has a point in time prior to the point in time of the first and second bridge backups, and the incremental backup has a point in time after the point in time of the first and second bridge backups.
12. The non-transitory storage medium of claim 11 , wherein the point in time for the recovery operation is associated with the initial backup and/or one or more incremental backups.
13. The non-transitory storage medium of the claim 12 , wherein the one or more incremental backups stored in the first vault are unencrypted.
14. The non-transitory storage medium of claim 13 , wherein each of the one or more incremental backups is a difference incremental backup and wherein the initial backup is a full backup.
15. The non-transitory storage medium of claim 13 , wherein the second bridge backup stored in the second vault corresponds to a same point in time as the first bridge backup stored in the first vault.
16. The non-transitory storage medium of claim 11 , wherein the bridge backups include one or more of difference backups and/or full backups.
17. The non-transitory storage medium of claim 11 , wherein the first vault is connected via an air gap to a backup appliance that generates backups of the production system.
18. The non-transitory storage medium of claim 11 , wherein the first vault comprises a backup storage system.
19. The non-transitory storage medium of claim 12 , further comprising recovering the backup using the starting backup from the second vault and incremental backups from the first vault and/or the second vault, wherein the starting backup is a full snapshot and wherein the one or more incremental backups are incremental snapshots.
20. The non-transitory storage medium of claim 19 , wherein a second key is known to the second vault.