1 00:00:00,258 --> 00:00:03,138 ATR2500x-USB Microphone & Logitech BRIO-2: Backup is not archive and archive is 2 00:00:03,138 --> 00:00:07,548 not backup frequent listeners to this show, know that we say this all the time. 3 00:00:08,028 --> 00:00:09,228 This episode. 4 00:00:09,508 --> 00:00:11,608 We're going to dig a little bit deeper and we're going to talk 5 00:00:11,608 --> 00:00:13,768 W. Curtis Preston (2): about exactly why that is the case. 6 00:00:14,338 --> 00:00:17,848 It really comes down mainly to eDiscovery. 7 00:00:18,118 --> 00:00:25,288 And why backup systems make a really bad tool when you get any discovery requests. 8 00:00:25,318 --> 00:00:29,668 If you live in a place where you are likely to get any discovery request, 9 00:00:29,668 --> 00:00:34,828 or if you're required to keep certain information, For compliance reasons. 10 00:00:35,098 --> 00:00:37,138 You need to listen to this episode. 11 00:00:37,198 --> 00:00:41,518 And interestingly enough, it ends up with kind of a surprise ending, 12 00:00:41,858 --> 00:00:46,088 one that came to me actually only after actually editing the episode. 13 00:00:46,658 --> 00:00:48,158 If this is your first time listening. 14 00:00:48,188 --> 00:00:51,428 Hi, I'm w Curtis Preston, AKA Mr. 15 00:00:51,428 --> 00:00:56,978 Backup, and I've dedicated my 30 year career to backup and recovery, disaster 16 00:00:57,008 --> 00:01:00,128 recovery, and anything near to that. 17 00:01:00,458 --> 00:01:05,948 And this podcast is dedicated to those unappreciated backup admins. 18 00:01:06,158 --> 00:01:09,158 We turn you into cyber recovery heroes. 19 00:01:09,368 --> 00:01:11,528 This is the backup wrap up. 20 00:01:24,276 --> 00:01:26,106 Welcome to the backup wrap up. 21 00:01:26,606 --> 00:01:29,966 I'm your host w Curtis Preston, and I have with me someone who 22 00:01:29,971 --> 00:01:35,426 apparently has much better ability to remember to do things than I do. 23 00:01:35,426 --> 00:01:37,706 Prasanna Malaiyandi 24 00:01:37,856 --> 00:01:38,306 W. Curtis Preston: how's it going? 25 00:01:38,306 --> 00:01:38,786 Persona. 26 00:01:38,851 --> 00:01:39,781 Prasanna: I am good. 27 00:01:39,781 --> 00:01:45,211 Curtis, what did I remember that I, that you seemed to forget? 28 00:01:45,901 --> 00:01:46,441 Oh, that's 29 00:01:46,441 --> 00:01:46,621 right. 30 00:01:49,391 --> 00:01:53,801 W. Curtis Preston: So we, uh, you know, in keeping with, you know, my 31 00:01:53,801 --> 00:01:57,161 philosophy, we do two recordings here. 32 00:01:57,461 --> 00:02:04,421 Uh, partly because we use a cloud, well, chiefly, I think because we use a cloud 33 00:02:04,421 --> 00:02:08,831 recording service that has been 98%. 34 00:02:09,536 --> 00:02:10,496 Reliable. 35 00:02:11,636 --> 00:02:16,251 And then sometimes it just doesn't have the recording, which is, 36 00:02:16,646 --> 00:02:17,996 which is incredibly frustrating. 37 00:02:17,996 --> 00:02:20,756 So we make a backup recording and we use something called OBS, 38 00:02:21,266 --> 00:02:25,256 which if it was just you and me, we probably could just use OBS. 39 00:02:25,766 --> 00:02:30,146 But, uh, you know, we, we have guests and installing OPS, isn't that 40 00:02:30,146 --> 00:02:30,716 helpful? 41 00:02:30,891 --> 00:02:33,291 . so anyway, but you remember today. 42 00:02:33,291 --> 00:02:33,591 And 43 00:02:33,591 --> 00:02:34,221 so we have 44 00:02:34,221 --> 00:02:34,581 our backup. 45 00:02:34,871 --> 00:02:35,231 Prasanna: Yeah. 46 00:02:35,231 --> 00:02:38,951 And then I know we're gonna get to the news in a second, the topics, but 47 00:02:39,221 --> 00:02:43,031 I think one of the things we should also mention is, uh, not only do we 48 00:02:43,031 --> 00:02:48,401 keep the recording of OBS locally, but we also upload it to a Google Drive. 49 00:02:48,676 --> 00:02:49,136 W. Curtis Preston: we do. 50 00:02:49,516 --> 00:02:49,736 We 51 00:02:50,111 --> 00:02:53,141 Prasanna: And one thing though that people may not realize. 52 00:02:53,271 --> 00:02:55,311 W. Curtis Preston: Two, one buddy. 53 00:02:55,871 --> 00:02:56,531 Prasanna: Exactly. 54 00:02:56,531 --> 00:02:59,561 I think one thing though people don't realize is I know you created a shared 55 00:02:59,561 --> 00:03:03,311 folder for us and throw things in, and over the weekend I got into a little bit 56 00:03:03,316 --> 00:03:06,941 of a hissy fit because I was like, why are you consuming my storage, Curtis? 57 00:03:08,931 --> 00:03:11,151 W. Curtis Preston: Yeah, I don't understand that at all. 58 00:03:11,331 --> 00:03:12,261 Where I 59 00:03:12,261 --> 00:03:13,071 share a drive with 60 00:03:13,071 --> 00:03:13,611 you 61 00:03:13,631 --> 00:03:14,351 Prasanna: you don't share drive. 62 00:03:14,351 --> 00:03:20,501 You share a shared folder, which is different than in enterprises 63 00:03:20,501 --> 00:03:22,181 where you create a shared drive. 64 00:03:22,706 --> 00:03:26,066 That has different association than creating a shared 65 00:03:26,166 --> 00:03:29,316 W. Curtis Preston: So you mean when you put it in there, it's still in your 66 00:03:29,316 --> 00:03:31,536 account, but it's sharing it with me. 67 00:03:32,706 --> 00:03:33,096 Oh, 68 00:03:33,101 --> 00:03:33,576 that's, 69 00:03:33,926 --> 00:03:35,306 Prasanna: it's basically an organization 70 00:03:35,306 --> 00:03:35,876 mechanism. 71 00:03:36,367 --> 00:03:36,877 W. Curtis Preston: Okay. 72 00:03:37,507 --> 00:03:37,927 All right. 73 00:03:38,587 --> 00:03:42,727 Well, hey, you know you learned something, uh, speaking of Google Drive, though. 74 00:03:43,312 --> 00:03:46,162 Uh, I think we have good news. 75 00:03:46,162 --> 00:03:47,542 I, I think this is good news. 76 00:03:47,542 --> 00:03:53,632 This is a follow up on the big Google Drive story that I, that I 77 00:03:53,632 --> 00:03:55,432 believe we reported on last week. 78 00:03:56,002 --> 00:04:01,702 And this was this thing where, uh, a bunch of Google users, there were like 79 00:04:02,092 --> 00:04:05,932 several hundred that had clicked the, this has also happened to me button 80 00:04:06,682 --> 00:04:12,682 and where basically all of the data since May had had disappeared and. 81 00:04:13,177 --> 00:04:18,787 The, the good news is that Google released a, uh, basically instructions 82 00:04:18,792 --> 00:04:23,227 and a blog post that talked about what to do, and it turned out that 83 00:04:23,677 --> 00:04:26,317 the data was never really gone. 84 00:04:26,407 --> 00:04:27,367 It was just data. 85 00:04:27,367 --> 00:04:30,067 It that, that, so first off, this. 86 00:04:30,847 --> 00:04:33,187 And you were right the first time you said it. 87 00:04:33,427 --> 00:04:36,127 When we talked about it last time, said that this only 88 00:04:36,132 --> 00:04:37,597 affected those with Google Drive. 89 00:04:37,597 --> 00:04:39,907 And I said, well, there are some people saying that they have the 90 00:04:39,907 --> 00:04:43,657 problem and they weren't using the desktop version of Google Drive. 91 00:04:44,017 --> 00:04:47,737 And you may recall I said they may be wrong, and it looks like they were. 92 00:04:48,307 --> 00:04:53,137 So, um, basically you needed to download the updated version of Google 93 00:04:53,137 --> 00:04:57,697 Drive and then click Restore from backup, which is interesting because. 94 00:04:59,227 --> 00:05:03,457 It means that there are files that are not quite in the drive but 95 00:05:03,457 --> 00:05:05,227 are stored, still stored locally. 96 00:05:05,227 --> 00:05:08,707 These are files that were not yet synced and that basically this 97 00:05:08,712 --> 00:05:13,117 should solve your problem, um, because it only affected files that 98 00:05:13,177 --> 00:05:16,567 that had not yet been synced to. 99 00:05:16,567 --> 00:05:20,677 Which I want to say, um, how do you not know that your drive 100 00:05:20,677 --> 00:05:22,222 has not been sinking since May? 101 00:05:24,202 --> 00:05:25,612 Um, right. 102 00:05:25,612 --> 00:05:26,002 Yeah. 103 00:05:26,002 --> 00:05:26,362 I, I 104 00:05:26,362 --> 00:05:26,632 don't know. 105 00:05:26,632 --> 00:05:26,872 That's 106 00:05:26,872 --> 00:05:27,502 just a thought. 107 00:05:27,762 --> 00:05:28,872 Prasanna: that it's kind of crazy. 108 00:05:28,872 --> 00:05:32,592 It's been like seven months and no one's noticed the problem. 109 00:05:32,592 --> 00:05:35,802 Like no one, like if you're using Google Drive for desktop, you've never gone 110 00:05:35,802 --> 00:05:38,772 to the web interface and been like, Hey, let me check if my file is there. 111 00:05:38,832 --> 00:05:41,472 Try to pull it down or use the Google Mobile app. 112 00:05:42,012 --> 00:05:43,602 You know, that's kind of crazy. 113 00:05:43,602 --> 00:05:43,662 I. 114 00:05:46,102 --> 00:05:52,642 W. Curtis Preston: Yeah, I think it's thi this really kind of drills to the heart 115 00:05:52,642 --> 00:06:00,082 of why I'm not that big of a fan of Google Drive as, or any similar drive like, 116 00:06:00,112 --> 00:06:00,532 uh, 117 00:06:00,762 --> 00:06:01,512 Prasanna: One drive. 118 00:06:01,527 --> 00:06:01,817 Yeah, 119 00:06:01,977 --> 00:06:05,752 W. Curtis Preston: Drive, um, is that the sinking process 120 00:06:05,812 --> 00:06:06,532 is 121 00:06:07,397 --> 00:06:07,617 not. 122 00:06:08,347 --> 00:06:12,877 Managed and reported on the way that a backup process typically was. 123 00:06:12,877 --> 00:06:19,147 So a sync failure apparently isn't bubbled up to anyone because you would think 124 00:06:19,147 --> 00:06:23,797 if they're using Google Drive desktop version, Google Drive would be flashing 125 00:06:23,797 --> 00:06:27,962 messages to them saying, Hey, you know, you haven't synced for seven months. 126 00:06:28,222 --> 00:06:29,522 You might wanna look into that. 127 00:06:30,922 --> 00:06:32,542 Um, yeah. 128 00:06:32,782 --> 00:06:35,962 Whereas a backup app is something that allows for centralized 129 00:06:35,962 --> 00:06:40,672 monitoring and, you know, especially when we talk about, um, companies. 130 00:06:41,332 --> 00:06:45,472 Anyway, I digress that, that that isn't what I wanted to talk about today. 131 00:06:45,689 --> 00:06:49,104 Prasanna: I do wanna say though, kudos to Google though for actually providing an 132 00:06:49,104 --> 00:06:54,804 update on both what the issue was, quickly resolving it and providing a patch. 133 00:06:56,464 --> 00:06:57,604 W. Curtis Preston: They did figure it out. 134 00:06:57,604 --> 00:06:58,564 They did fix it. 135 00:06:58,654 --> 00:07:03,634 And it looks like, um, my, my favorite part of the instructions 136 00:07:03,634 --> 00:07:09,124 were if you click the Restore, you're gonna either get, uh, two messages. 137 00:07:09,124 --> 00:07:12,995 Either Restore was successful or you're outta space if you get the second one. 138 00:07:13,789 --> 00:07:14,009 Um. 139 00:07:15,184 --> 00:07:17,134 You should really go get some more space. 140 00:07:17,854 --> 00:07:21,754 It just, they did like in a nice little professional way, and I 141 00:07:21,754 --> 00:07:25,899 really wanted them to go, Hey dude, man, clear out your drive, you 142 00:07:25,899 --> 00:07:26,059 know? 143 00:07:27,039 --> 00:07:27,459 Prasanna: Uh, 144 00:07:27,634 --> 00:07:28,984 W. Curtis Preston: Uh, anyway. 145 00:07:29,404 --> 00:07:30,064 Anyway, 146 00:07:30,214 --> 00:07:30,394 so 147 00:07:30,399 --> 00:07:32,164 you want, you wanna talk about the 23 and Me 148 00:07:32,324 --> 00:07:35,829 Prasanna: So I came across this article recently, so it looks like 23, and 149 00:07:35,829 --> 00:07:42,909 me had a security breach recently, and it was kind of alarming What was, 150 00:07:43,209 --> 00:07:44,469 what the media was talking about. 151 00:07:44,469 --> 00:07:46,449 They were like, oh, 23 and me was breached. 152 00:07:46,449 --> 00:07:49,599 All this information is available on something like. 153 00:07:50,289 --> 00:07:52,509 I think it was like, what was it? 154 00:07:52,509 --> 00:07:57,819 6.9 million I think was the number of users and it's like, wow. 155 00:07:58,059 --> 00:07:59,349 And they didn't have any other information. 156 00:07:59,349 --> 00:07:59,559 Right. 157 00:07:59,559 --> 00:08:01,989 So it's like 23 and me for those not familiar, it's 158 00:08:02,044 --> 00:08:02,569 W. Curtis Preston: Sounds very 159 00:08:02,859 --> 00:08:05,229 Prasanna: It's like an ancestry website where you can upload your 160 00:08:05,229 --> 00:08:09,429 DNA profile and it'll help connect with other people who may be related 161 00:08:09,429 --> 00:08:10,689 to you that you may not know about. 162 00:08:11,379 --> 00:08:15,699 And so with that DNA profile, it's like, wow, if hackers got into 23 and 163 00:08:15,699 --> 00:08:18,489 me, they're able to pull down your DNA. 164 00:08:18,519 --> 00:08:19,869 And what could they do with that? 165 00:08:19,869 --> 00:08:23,619 Like all this data could be used for nefarious purposes 166 00:08:23,619 --> 00:08:24,579 and other things like that. 167 00:08:25,204 --> 00:08:25,504 W. Curtis Preston: They could 168 00:08:26,134 --> 00:08:28,524 Prasanna a clone. 169 00:08:28,689 --> 00:08:29,289 Prasanna: in 10 years. 170 00:08:30,459 --> 00:08:30,849 Right. 171 00:08:31,239 --> 00:08:33,369 But, and so it was very scary. 172 00:08:33,369 --> 00:08:38,889 And just yesterday or uh, yeah, yesterday they just published an 173 00:08:38,889 --> 00:08:43,029 update from 23 and me saying, Hey, we figured out what the issue was. 174 00:08:43,034 --> 00:08:47,529 And once again, like the Google, I'm glad they were very transparent, so. 175 00:08:48,319 --> 00:08:48,889 W. Curtis Preston: Yeah, 176 00:08:48,963 --> 00:08:54,903 Prasanna: So what ended up happening was, uh, hackers basically use credential 177 00:08:54,903 --> 00:08:58,083 stuffing to access 14,000 accounts. 178 00:08:58,443 --> 00:09:00,468 Uh, what credential stuffing is, is they basically. 179 00:09:01,558 --> 00:09:05,098 Figured out that there was another website that was compromised. 180 00:09:05,308 --> 00:09:08,608 They downloaded those username and passwords and they use those compromised 181 00:09:08,608 --> 00:09:13,348 credentials and just started atta uh, using those same logins on 23. 182 00:09:13,348 --> 00:09:13,798 And me. 183 00:09:14,308 --> 00:09:17,188 And like we always talk about Curtis, people should be using 184 00:09:17,193 --> 00:09:19,918 different passwords on different websites and they should definitely 185 00:09:20,008 --> 00:09:21,688 be using a password manager, right. 186 00:09:22,848 --> 00:09:27,223 W. Curtis Preston: If, if, if everybody did what we tell them to do, which is 187 00:09:27,223 --> 00:09:29,203 don't use the same password anywhere. 188 00:09:29,743 --> 00:09:32,233 And use MFA, right? 189 00:09:32,953 --> 00:09:36,583 This hack would never have happened if, if these 14,000 and 190 00:09:36,583 --> 00:09:38,713 I, I, I, I'm not, I don't know. 191 00:09:38,773 --> 00:09:40,448 It, it sounds like victim blaming it. 192 00:09:40,453 --> 00:09:41,413 It is what it is. 193 00:09:41,743 --> 00:09:48,463 This is your job as a person, as a company to, to, to prevent the, you 194 00:09:48,463 --> 00:09:50,383 know, the stealing of your information. 195 00:09:50,383 --> 00:09:55,783 And if you just do all the things that you're not supposed to do, you know, 196 00:09:55,783 --> 00:09:57,283 your chances of getting hacked are much 197 00:09:57,283 --> 00:09:57,823 much higher. 198 00:09:58,753 --> 00:10:01,243 W. Curtis Preston (2): An interesting update to this story since we 199 00:10:01,243 --> 00:10:03,493 actually recorded this news item. 200 00:10:03,763 --> 00:10:05,143 And that is that. 201 00:10:05,533 --> 00:10:06,103 23. 202 00:10:06,103 --> 00:10:10,453 And me basically came out and said what we just said, which is, you know, 203 00:10:10,453 --> 00:10:15,343 if you hadn't reused your passwords, Uh, you know, from other sites on our 204 00:10:15,343 --> 00:10:17,473 site, you wouldn't have gotten hacked. 205 00:10:17,863 --> 00:10:19,753 And they got lambasted for it. 206 00:10:19,753 --> 00:10:25,243 Basically, they said, you know, 23 and me is blaming their users for their hack. 207 00:10:25,783 --> 00:10:28,603 It wasn't a hack, right? 208 00:10:28,603 --> 00:10:33,373 It wasn't a hack of 23 and me, it was, they went and got other people's 209 00:10:33,373 --> 00:10:36,913 credentials from, you know, their user's credentials from other sites. 210 00:10:37,333 --> 00:10:40,873 And they tried those credentials on 23 and me and they logged in. 211 00:10:42,073 --> 00:10:44,443 I, you know, I I'm, I have to say. 212 00:10:45,013 --> 00:10:51,373 Um, you know, I'm pretty much on 23 and me side here do not reuse your credentials. 213 00:10:51,763 --> 00:10:52,903 On other sides. 214 00:10:52,933 --> 00:10:55,333 Number one, number two, turn on MFA. 215 00:10:55,813 --> 00:10:56,173 Right? 216 00:10:56,203 --> 00:11:00,883 If, if, if you had done both or either of those things, Uh, you would 217 00:11:00,883 --> 00:11:02,383 not have been subject to this hack. 218 00:11:02,443 --> 00:11:04,603 I, you know, I don't know what else to say. 219 00:11:04,653 --> 00:11:07,413 Prasanna: Now, so it's not as bad, right? 220 00:11:07,413 --> 00:11:08,673 So it's 14,000 people. 221 00:11:08,673 --> 00:11:11,103 They didn't go to the backend systems and pull in all the data. 222 00:11:11,108 --> 00:11:13,353 They went through the front door, right? 223 00:11:13,683 --> 00:11:16,533 And so they saw whatever that user could have seen. 224 00:11:16,533 --> 00:11:16,803 Now. 225 00:11:17,748 --> 00:11:22,068 The downside is it wasn't just those 14,000 people and 226 00:11:22,068 --> 00:11:23,478 their information, right? 227 00:11:23,718 --> 00:11:27,498 Because with 23 and me, you could say, Hey, who else am I connected to? 228 00:11:27,498 --> 00:11:28,848 And you could look at their 229 00:11:29,448 --> 00:11:31,548 DNA relatives is what they call it. 230 00:11:31,548 --> 00:11:35,988 And you can also build a family tree, which also exposes a personal data of 231 00:11:35,993 --> 00:11:38,178 people you're connected to potentially. 232 00:11:39,088 --> 00:11:39,568 W. Curtis Preston: Right. 233 00:11:39,628 --> 00:11:40,243 Yeah, it is. 234 00:11:40,248 --> 00:11:43,648 It is an optional feature, but it's probably an optional feature 235 00:11:43,648 --> 00:11:45,178 that people use quite a bit. 236 00:11:45,643 --> 00:11:49,693 And you know, it shows, you know, it shows a lot about you, right? 237 00:11:49,693 --> 00:11:53,683 You're, you know, you know, obviously things like when you last logged in and it 238 00:11:53,683 --> 00:11:57,523 shows the people that you're related to, which may expose family relationships that 239 00:11:57,523 --> 00:12:00,853 you had not intended to expose publicly. 240 00:12:00,853 --> 00:12:00,913 I. 241 00:12:01,183 --> 00:12:05,893 Uh, there, the scariest part was, it, it, it said, it talks about DNA segments. 242 00:12:06,308 --> 00:12:08,953 It, it shows that the DNA segments that you have in common. 243 00:12:08,983 --> 00:12:12,133 I, I haven't looked at that specifically, so I don't know exactly what that means, 244 00:12:12,613 --> 00:12:16,663 but I, I think it's important to say that what it doesn't, what you're not 245 00:12:16,663 --> 00:12:21,013 able to do as a 23 and me customer, is to download your actual DNA profile. 246 00:12:21,403 --> 00:12:21,703 Right. 247 00:12:22,333 --> 00:12:25,003 The thing that, that I was joking about earlier, you know, cloning, 248 00:12:25,018 --> 00:12:26,833 you're not, you're not able to do that. 249 00:12:27,193 --> 00:12:33,223 And so while this sounds like a huge breach, the only thing I think that 250 00:12:33,228 --> 00:12:41,053 23 and Me could have done to prevent this is to force MFA on all customers. 251 00:12:41,773 --> 00:12:47,263 And you know, it's something that you as a company, I think should think about, 252 00:12:47,773 --> 00:12:48,523 um, 253 00:12:48,553 --> 00:12:49,093 that. 254 00:12:51,148 --> 00:12:53,218 You know, especially if you have sensitive data. 255 00:12:53,278 --> 00:12:53,698 Right. 256 00:12:54,208 --> 00:12:58,828 And I, I can't think of any data more sensitive than DNA profile. 257 00:12:58,888 --> 00:12:59,248 Right. 258 00:12:59,908 --> 00:13:03,808 Um, that's about, I mean, what the customers could have done 259 00:13:03,868 --> 00:13:07,588 is you use a different password and, and turn on, I'm sure. 260 00:13:08,083 --> 00:13:13,873 23 and Me has MFA enabled or available to you, but many people might not use it. 261 00:13:13,933 --> 00:13:18,013 Apparently 14,000 people, at least 14,000 people don't use it. 262 00:13:18,643 --> 00:13:19,273 So 263 00:13:19,908 --> 00:13:24,648 Prasanna: I also do wonder if companies should start integrating 264 00:13:24,648 --> 00:13:26,898 with things like, what is it? 265 00:13:27,618 --> 00:13:28,518 Am I owned? 266 00:13:28,788 --> 00:13:29,208 right. 267 00:13:31,278 --> 00:13:31,668 right. 268 00:13:31,698 --> 00:13:33,018 Those and I Pond. 269 00:13:33,108 --> 00:13:33,318 Yeah. 270 00:13:33,348 --> 00:13:33,918 Am I Pond? 271 00:13:34,188 --> 00:13:34,548 Yeah. 272 00:13:34,818 --> 00:13:35,118 Right. 273 00:13:35,118 --> 00:13:37,968 And it's those websites that I think companies should start 274 00:13:37,968 --> 00:13:40,458 thinking about integrating with and being like, Hey, there's already 275 00:13:40,458 --> 00:13:42,258 a list of breaches out there. 276 00:13:42,648 --> 00:13:46,578 So has this username password, the hash of the password been used elsewhere. 277 00:13:48,423 --> 00:13:49,083 So they could 278 00:13:49,153 --> 00:13:51,343 W. Curtis Preston: Oh, that's actually, I really like that 279 00:13:51,343 --> 00:13:54,583 idea Prasanna of basically. 280 00:13:55,768 --> 00:14:03,688 Proactively going through your username, um, and password database 281 00:14:04,108 --> 00:14:13,018 using the MI pond, uh, database to say here is, but you won't get, I 282 00:14:13,018 --> 00:14:16,228 guess the only thing you'll be able to notify, you'll be able to notify a 283 00:14:16,228 --> 00:14:24,058 person that this username, this email address has been owned in another site. 284 00:14:24,883 --> 00:14:26,473 And notifying. 285 00:14:26,593 --> 00:14:29,713 I was, I was thinking for a minute there that you could figure out if 286 00:14:29,713 --> 00:14:30,193 the actual 287 00:14:30,198 --> 00:14:31,003 password 288 00:14:31,173 --> 00:14:31,983 Prasanna: I wonder if you could use 289 00:14:32,113 --> 00:14:32,773 W. Curtis Preston: used. 290 00:14:34,428 --> 00:14:34,638 Prasanna: But 291 00:14:34,723 --> 00:14:36,223 W. Curtis Preston: Well, you could use that, but they don't put the 292 00:14:36,223 --> 00:14:39,643 password in the am I pond, right? 293 00:14:39,643 --> 00:14:41,233 They just say that, um, 294 00:14:41,383 --> 00:14:41,533 you 295 00:14:41,533 --> 00:14:42,218 know, um, 296 00:14:42,378 --> 00:14:44,358 Prasanna: Maybe that's a service that they should offer. 297 00:14:46,273 --> 00:14:46,933 W. Curtis Preston: who am I, 298 00:14:46,933 --> 00:14:47,473 pond? 299 00:14:48,198 --> 00:14:52,278 Prasanna: For companies to integrate, be like, Hey, we have, because they 300 00:14:52,278 --> 00:14:55,638 must have the hashes, you know, because they're getting the data from somewhere. 301 00:14:57,598 --> 00:14:58,108 W. Curtis Preston: Right. 302 00:14:58,708 --> 00:14:59,218 Yeah. 303 00:14:59,578 --> 00:15:02,998 There's a, there's a, I think there's, there's some money to 304 00:15:02,998 --> 00:15:05,188 be made there, I think, right? 305 00:15:05,458 --> 00:15:06,148 Um, 306 00:15:06,588 --> 00:15:06,978 Prasanna: yeah. 307 00:15:07,008 --> 00:15:09,888 The one other thing I would say is, and they didn't go into a lot of 308 00:15:09,888 --> 00:15:14,778 detail, so the breach happened back in October, so it's not known how 309 00:15:14,778 --> 00:15:22,038 long it took before they saw the issue and how also the attackers were. 310 00:15:22,743 --> 00:15:24,123 Forcing themselves in. 311 00:15:24,453 --> 00:15:27,363 For instance, if the attackers, and I'm sure attackers don't do this, right, but 312 00:15:27,363 --> 00:15:31,293 if they start coming from a region that you normally don't log in from, that 313 00:15:31,293 --> 00:15:32,523 should have been flagged immediately. 314 00:15:32,763 --> 00:15:33,063 You know? 315 00:15:33,063 --> 00:15:36,573 So their intrusion detection system should have realized, Hey, you're 316 00:15:36,573 --> 00:15:39,513 logging in from the east coast of the us. 317 00:15:39,513 --> 00:15:41,553 You normally log in from the west coast. 318 00:15:42,153 --> 00:15:43,818 Yeah, we should probably check and see. 319 00:15:44,158 --> 00:15:47,008 W. Curtis Preston: I, but I, I agree. 320 00:15:47,043 --> 00:15:51,748 I, I mean, I agree, but I'm just thinking about like, I don't know any, like 321 00:15:51,748 --> 00:15:56,068 the only, the only website or service that I log into like that where it 322 00:15:56,073 --> 00:15:59,428 says, Hey, you're in a different spot, is Netflix, and the only reason that 323 00:15:59,428 --> 00:16:02,548 that's the case is because I'm not supposed to watch outside of my home. 324 00:16:02,548 --> 00:16:03,568 They're not, They're not, 325 00:16:03,568 --> 00:16:03,928 thinking 326 00:16:04,248 --> 00:16:07,578 Prasanna: But, but, uh, there are other websites though, like that look 327 00:16:07,578 --> 00:16:10,668 and see, okay, are you logging in, like Google, for instance, right? 328 00:16:10,848 --> 00:16:12,558 Hey, you're logging in from this remote place. 329 00:16:12,558 --> 00:16:13,428 Are you sure that's you? 330 00:16:13,433 --> 00:16:13,638 And they 331 00:16:13,743 --> 00:16:14,878 W. Curtis Preston: a different place. 332 00:16:15,318 --> 00:16:17,658 Prasanna: And they send you a email, right? 333 00:16:17,718 --> 00:16:19,068 Or Apple does it 334 00:16:19,228 --> 00:16:20,518 W. Curtis Preston: If, if, 335 00:16:20,998 --> 00:16:21,598 if you've 336 00:16:21,603 --> 00:16:22,078 enabled 337 00:16:22,308 --> 00:16:22,638 Prasanna: No, no, no. 338 00:16:22,638 --> 00:16:24,618 But it doesn't even have to be MFA, right? 339 00:16:24,618 --> 00:16:25,698 At least a notification. 340 00:16:25,708 --> 00:16:26,068 W. Curtis Preston: sure? 341 00:16:26,838 --> 00:16:29,478 Prasanna: Well, well, I think at least getting a notification. 342 00:16:31,738 --> 00:16:32,248 W. Curtis Preston: Okay. 343 00:16:32,278 --> 00:16:32,668 Okay. 344 00:16:32,668 --> 00:16:33,568 That, yeah, that's true. 345 00:16:33,568 --> 00:16:35,068 That's something that they could do, right? 346 00:16:35,068 --> 00:16:36,538 They could notify users. 347 00:16:36,538 --> 00:16:36,928 Yeah. 348 00:16:37,018 --> 00:16:37,438 Yeah. 349 00:16:37,468 --> 00:16:41,068 Hey, uh, just so you know, someone's logging in from Russia 350 00:16:41,878 --> 00:16:42,778 with your, 351 00:16:42,898 --> 00:16:44,758 um, of course 352 00:16:44,878 --> 00:16:45,088 that, 353 00:16:45,718 --> 00:16:45,958 yeah. 354 00:16:45,958 --> 00:16:48,508 From a new browser, because you can fake VPNs, right? 355 00:16:48,508 --> 00:16:49,798 You can use VPNs to fake. 356 00:16:49,803 --> 00:16:49,873 Yeah. 357 00:16:52,113 --> 00:16:52,893 Prasanna: So I think there are 358 00:16:53,098 --> 00:16:53,878 W. Curtis Preston: So, I, I, 359 00:16:53,883 --> 00:16:54,093 Prasanna: and I 360 00:16:54,093 --> 00:16:57,813 don't know what systems they have in place at 23 and me, but hopefully they are 361 00:16:57,813 --> 00:17:00,723 reconsidering what systems they have to prevent things like this from happening. 362 00:17:02,113 --> 00:17:02,863 W. Curtis Preston: Yeah, agreed. 363 00:17:02,863 --> 00:17:06,163 I, I guess just short version here is this wasn't as bad as 364 00:17:06,163 --> 00:17:07,213 we thought it was initially. 365 00:17:07,213 --> 00:17:09,823 This wasn't an attack, this wasn't a backend attack. 366 00:17:10,213 --> 00:17:13,363 It is officially a breach because it was, you know, their company. 367 00:17:13,873 --> 00:17:17,983 This was basically a bunch of people who could have prevented the breach 368 00:17:18,073 --> 00:17:21,823 by just changing, you know, using different passwords and enabling MFA. 369 00:17:22,473 --> 00:17:25,773 Um, it sounds like they could have done some additional things to, to, 370 00:17:25,893 --> 00:17:29,013 uh, ameliorate this, uh, as a company. 371 00:17:29,493 --> 00:17:38,013 And we also, we don't yet know if they, um, um, if the, like the hack, you said 372 00:17:38,013 --> 00:17:39,693 that this, this happened in October. 373 00:17:40,083 --> 00:17:43,623 Did they sit on it for two months or did they just not know 374 00:17:43,623 --> 00:17:44,193 for two months? 375 00:17:44,193 --> 00:17:44,763 That's also 376 00:17:44,913 --> 00:17:46,833 Prasanna: Now the one thing is they did bring in forensic 377 00:17:47,283 --> 00:17:50,463 investigators to figure out what's going on, so I will also give 'em 378 00:17:50,698 --> 00:17:54,268 W. Curtis Preston: so maybe it, maybe it took, yeah, maybe it took that long. 379 00:17:55,108 --> 00:17:57,928 All right, well that's the news of the week 380 00:18:01,768 --> 00:18:02,068 All right. 381 00:18:02,068 --> 00:18:07,528 This week I thought we would dive, uh, a little bit deeper into archive, 382 00:18:07,528 --> 00:18:10,918 if you want the basics of the difference between backup and archive. 383 00:18:10,923 --> 00:18:14,068 There are a couple of episodes from a little bit, a little bit ago. 384 00:18:15,208 --> 00:18:19,118 Um, it just says, what is Archive and retrieve as opposed 385 00:18:19,118 --> 00:18:20,678 to what is backup and restore. 386 00:18:20,833 --> 00:18:22,148 Prasanna: We will put that in the show notes, right? 387 00:18:22,148 --> 00:18:23,888 In case you want to go back and listen to that. 388 00:18:23,888 --> 00:18:24,848 W. Curtis Preston: yeah, we'll put a link. 389 00:18:24,853 --> 00:18:25,148 Yeah. 390 00:18:25,148 --> 00:18:25,448 Thanks. 391 00:18:25,448 --> 00:18:28,988 We'll put a link in the show notes to that, uh, episode. 392 00:18:29,593 --> 00:18:33,008 If, if you wanna go listen to that before you wanna listen to this, we're 393 00:18:33,008 --> 00:18:37,238 gonna go a little bit deeper into what is Archive 'cause it is very different. 394 00:18:37,568 --> 00:18:43,178 What, um, do, do you remember how I, how I, um, sort of separate the two? 395 00:18:44,108 --> 00:18:44,648 Prasanna: What was it? 396 00:18:44,648 --> 00:18:52,028 It was, I believe one of the points you talk about is backup is. 397 00:18:52,598 --> 00:18:56,828 Restoring your, what your environment looks like to a point in time 398 00:18:56,828 --> 00:19:00,308 that plausibly existed, right? 399 00:19:00,428 --> 00:19:04,208 Archive is you get a whole bunch of data back and the way you 400 00:19:04,213 --> 00:19:06,758 search is very different, right? 401 00:19:06,758 --> 00:19:11,378 Usually backup is, I wanna go back to a point in time archive is I'm looking 402 00:19:11,378 --> 00:19:17,348 for all the emails from Curtis or those types of things where you're, what you 403 00:19:17,348 --> 00:19:19,178 end up with from an archive perspective. 404 00:19:19,553 --> 00:19:23,153 Is never a plausible point in time, or it may never be a plausible 405 00:19:23,153 --> 00:19:24,893 point in time in the life of that 406 00:19:24,908 --> 00:19:25,238 W. Curtis Preston: right. 407 00:19:26,378 --> 00:19:27,068 Absolutely. 408 00:19:27,353 --> 00:19:28,673 Prasanna: Is that fairly accurate? 409 00:19:28,753 --> 00:19:30,523 W. Curtis Preston: That, that's absolutely it, right? 410 00:19:30,523 --> 00:19:34,423 So it's basically a, a, a backup is to do a restore and 411 00:19:34,423 --> 00:19:35,833 an archive is to do a retrieve. 412 00:19:36,133 --> 00:19:39,883 And the difference between a restore and a retrieve is that a restore 413 00:19:40,213 --> 00:19:44,083 is basically restoring your system back to a particular point in time. 414 00:19:44,443 --> 00:19:46,903 Even if it's just one file, you're restoring one file. 415 00:19:47,053 --> 00:19:48,313 If you're just doing one file. 416 00:19:49,078 --> 00:19:52,948 Technically, I suppose you could use either, but generally we're talking about 417 00:19:53,428 --> 00:19:58,498 many files, and so with a restore, you're restoring the system to the way it looked. 418 00:19:58,498 --> 00:20:03,088 Generally speaking, just a few minutes ago or perhaps yesterday, 419 00:20:03,088 --> 00:20:04,723 basically to the most recent backup. 420 00:20:06,133 --> 00:20:10,423 Um, and, and possibly to something before that, especially in the 421 00:20:10,423 --> 00:20:11,803 case of a ransomware attack. 422 00:20:11,803 --> 00:20:15,013 You want to pick a particular point in time because it's before the ransomware 423 00:20:15,193 --> 00:20:20,503 attack happened, but the whole point is to bring it back to a point in time. 424 00:20:21,013 --> 00:20:26,683 That's a point in time that you know, whereas with archive, it's about, I 425 00:20:26,683 --> 00:20:35,293 need some information that matches a particular set of criteria that I. 426 00:20:35,983 --> 00:20:42,343 Um, and I don't even know where that information might be. 427 00:20:42,553 --> 00:20:42,853 Right. 428 00:20:42,853 --> 00:20:46,963 That's, that's another big difference between a backup and an archive, is 429 00:20:46,963 --> 00:20:51,973 that with a backup, we know we're restoring system A, you know, Apollo, 430 00:20:51,973 --> 00:20:55,633 we're restoring it to the way it looked yesterday with an archive. 431 00:20:55,633 --> 00:20:58,333 We are, you know, you gave an example, we're looking for Curtis' 432 00:20:58,333 --> 00:21:04,813 emails, um, or we're looking for any documents that Curtis created. 433 00:21:05,803 --> 00:21:07,513 In this span of time. 434 00:21:07,843 --> 00:21:11,173 It could be emails, it could be written documents, it could be 435 00:21:11,173 --> 00:21:14,293 drawings, it could be whatever, right? 436 00:21:14,298 --> 00:21:23,053 A, a perfect example of this is, let's say I work for a firm where my job is 437 00:21:23,053 --> 00:21:28,003 to design stuff, design widgets, and. 438 00:21:29,368 --> 00:21:31,348 What goes into designing those widgets? 439 00:21:31,348 --> 00:21:34,108 As I work there, I'm going to create drawings. 440 00:21:34,108 --> 00:21:37,138 I'm gonna create, uh, do we still call them CAD drawings? 441 00:21:37,138 --> 00:21:39,538 I don't if we even do we still, yeah, we 442 00:21:39,583 --> 00:21:40,153 Prasanna: accurate. 443 00:21:41,503 --> 00:21:42,343 I think it's still accurate. 444 00:21:43,198 --> 00:21:44,068 W. Curtis Preston: Yeah, I think so too. 445 00:21:44,608 --> 00:21:47,128 Um, I'm gonna create drawings of what I'm doing. 446 00:21:47,128 --> 00:21:51,898 I'm gonna create conceptual drawings, perhaps, uh, actual physical drawings. 447 00:21:51,898 --> 00:21:55,478 I'm going to have emails where I go back and forth, Prasanna, 448 00:21:55,498 --> 00:21:56,518 what do you think of this? 449 00:21:56,518 --> 00:21:58,048 And you're like, yes, I like it. 450 00:21:58,618 --> 00:22:01,528 I'm gonna have documents where I describe the requirements 451 00:22:01,528 --> 00:22:03,148 for the widget that I'm making. 452 00:22:03,658 --> 00:22:05,188 Can you think of anything else that I might 453 00:22:05,508 --> 00:22:06,748 Prasanna: It's like meeting recordings. 454 00:22:07,648 --> 00:22:08,548 W. Curtis Preston: Meeting recordings. 455 00:22:08,548 --> 00:22:09,148 Absolutely. 456 00:22:09,148 --> 00:22:14,128 Meeting notes where we discuss, uh, what I'm up to now, why 457 00:22:14,128 --> 00:22:15,328 would all of that matter? 458 00:22:15,328 --> 00:22:20,638 Because it's, let's say a couple years down the road and I've left 459 00:22:20,643 --> 00:22:24,598 the company and I've gone to a competitor, and suddenly the competitor 460 00:22:24,598 --> 00:22:26,458 comes out with an identical widget. 461 00:22:27,463 --> 00:22:31,933 And, uh, my former employer is now accusing me of stealing 462 00:22:31,933 --> 00:22:33,193 intellectual property. 463 00:22:33,553 --> 00:22:37,663 And what, so what they want is they want proof that I worked 464 00:22:37,663 --> 00:22:42,103 on that widget at this company. 465 00:22:42,433 --> 00:22:46,663 And so, um, they're going to, they want all these things. 466 00:22:46,663 --> 00:22:49,033 They want all the emails, they want all the documents, they want all the CAD 467 00:22:49,033 --> 00:22:50,623 drawings, they want all the meeting notes. 468 00:22:50,623 --> 00:22:52,153 They want all of these things. 469 00:22:53,578 --> 00:22:57,958 And they, they all have, and the widget, you know, the widget has a name. 470 00:22:58,108 --> 00:22:58,468 Right? 471 00:22:58,678 --> 00:23:00,658 That's one of the reasons we have project names. 472 00:23:00,658 --> 00:23:00,988 Right. 473 00:23:01,648 --> 00:23:06,028 Uh, the widget has a name and so we just want every email where I mention that 474 00:23:06,033 --> 00:23:09,778 project name, I want every drawing with it's named after it, et cetera, et cetera. 475 00:23:09,988 --> 00:23:14,278 Or just maybe if we, if we wanna cast a wide net, we just want 476 00:23:14,278 --> 00:23:16,978 any CAD drawings that Curtis did from this time to this time. 477 00:23:17,050 --> 00:23:18,070 Can you think of anything else? 478 00:23:18,447 --> 00:23:24,657 Prasanna: One other key aspect is that project may not exist on any production 479 00:23:24,657 --> 00:23:27,447 storage system anywhere else, right? 480 00:23:27,477 --> 00:23:30,837 The only copy may exist in this archive system. 481 00:23:31,617 --> 00:23:34,617 And you don't even know what system it initially existed on. 482 00:23:34,617 --> 00:23:36,777 Maybe that system has been retired, right? 483 00:23:36,777 --> 00:23:37,497 You don't know. 484 00:23:37,497 --> 00:23:38,457 You don't care. 485 00:23:38,787 --> 00:23:42,267 What you're really focused on is finding everything associated with this project, 486 00:23:42,267 --> 00:23:45,717 or like you mentioned, any CAD drawing that Curtis did between this timeframe. 487 00:23:47,367 --> 00:23:50,637 W. Curtis Preston: Yeah, exactly, because this may be happening. 488 00:23:51,462 --> 00:23:57,732 A few months, a few years, many years later, you don't have any knowledge 489 00:23:57,792 --> 00:24:00,792 of the servers or the applications. 490 00:24:00,792 --> 00:24:05,412 You don't remember if you were using Google Drive or perhaps maybe there was 491 00:24:05,412 --> 00:24:11,622 an outage in Google Drive and you switched over to Microsoft 365 or the vice versa. 492 00:24:12,672 --> 00:24:17,742 And you, you don't remember those things, and that's why you have an archive. 493 00:24:17,742 --> 00:24:21,252 And you can go in and just ask for information. 494 00:24:21,252 --> 00:24:26,832 Show me, uh, drawings that, um, you know, show me the CAD drawings. 495 00:24:26,832 --> 00:24:32,832 Show me the emails, show me the, um, uh, any documents that Curtis was working 496 00:24:32,832 --> 00:24:34,662 on that have these phrases in them. 497 00:24:35,652 --> 00:24:39,072 Um, because that is, um. 498 00:24:39,627 --> 00:24:43,497 The, the, the thing that you touched on is a really important part is that 499 00:24:43,497 --> 00:24:45,537 you don't know where this stuff is. 500 00:24:45,897 --> 00:24:52,377 The other thing is, it's not a point in time, it is a range of time, right? 501 00:24:52,382 --> 00:24:58,497 It's going from basically anything Curtis worked on in 2023 and, um, 502 00:24:58,527 --> 00:25:01,767 because again, we've accused him of stealing an an electric property. 503 00:25:01,767 --> 00:25:03,567 We wanna show that he created it here. 504 00:25:03,567 --> 00:25:05,007 So we wanna just see everything. 505 00:25:05,487 --> 00:25:08,997 Uh, and then you have a team once you do that. 506 00:25:09,402 --> 00:25:12,612 Prasanna: I think the other key though with the archive is, especially depending 507 00:25:12,612 --> 00:25:18,672 on the system, it doesn't matter if you, Curtis had created a, like a working 508 00:25:19,092 --> 00:25:21,012 document and then deleted it, right? 509 00:25:21,012 --> 00:25:23,742 It doesn't matter any of that, because as long as the archive 510 00:25:23,772 --> 00:25:26,352 captured that copy, it's still there. 511 00:25:26,352 --> 00:25:29,082 Regardless of what you do and the time, if you delete it or whatever else, the 512 00:25:29,082 --> 00:25:31,122 archive holds that copy, so it's there, 513 00:25:32,002 --> 00:25:33,447 W. Curtis Preston: Right, right. 514 00:25:33,862 --> 00:25:35,632 Prasanna: So you have all this documents, right? 515 00:25:35,632 --> 00:25:37,342 From 2023, everything. 516 00:25:37,612 --> 00:25:40,282 Now you need some ability to go through, right? 517 00:25:40,282 --> 00:25:43,942 And usually you will have your legal team or someone else go through and 518 00:25:43,942 --> 00:25:48,202 sort of filter and really figure out, okay, what is relevant, what is not? 519 00:25:48,207 --> 00:25:52,912 Because there might be thousands of documents that Curtis created in 2023, 520 00:25:53,302 --> 00:25:55,942 and so now you need that ability to figure out, okay, which are the ones 521 00:25:55,942 --> 00:26:00,742 that are relevant for this IP case versus which are the ones that are not? 522 00:26:01,552 --> 00:26:05,332 Because you don't, you wanna find the needles in the haystack, right? 523 00:26:05,362 --> 00:26:09,772 Not give everything over to, for discovery purposes, right? 524 00:26:09,772 --> 00:26:11,272 For legal discovery purposes. 525 00:26:11,668 --> 00:26:15,838 W. Curtis Preston: So we've talked primarily about e-discovery as one of the 526 00:26:15,838 --> 00:26:20,728 reasons we archive, and that is probably. 527 00:26:21,523 --> 00:26:26,353 The primary reason I think many companies archive, they may actually have a 528 00:26:26,563 --> 00:26:31,843 regulatory requirement to archive, to basically be able to show any version, 529 00:26:31,843 --> 00:26:34,753 any, um, you know, any conversation. 530 00:26:35,053 --> 00:26:38,053 I know that like, for example, I. 531 00:26:38,143 --> 00:26:42,043 Uh, financial trading firms have to show any conversations with customers. 532 00:26:42,043 --> 00:26:46,213 So they archive every conversation with a customer, whether it's audio 533 00:26:46,213 --> 00:26:47,653 or text or, you know, anything. 534 00:26:47,653 --> 00:26:50,653 Like they have to archive that so that they can then search it later. 535 00:26:51,103 --> 00:26:55,243 When you, uh, when the customer said that you promised them a 536 00:26:55,243 --> 00:26:57,853 certain financial return and you're like, uh, never did that. 537 00:26:57,943 --> 00:26:58,363 Right? 538 00:26:58,813 --> 00:27:01,093 And then it's like, uh, yeah, actually you totally did that. 539 00:27:03,733 --> 00:27:07,993 I think that probably is the primary reason many people archive, but 540 00:27:08,443 --> 00:27:13,333 if we look at the other reason to do archive is storage management. 541 00:27:13,333 --> 00:27:14,293 You wanna talk about that? 542 00:27:14,308 --> 00:27:14,638 Prasanna: Yeah. 543 00:27:14,668 --> 00:27:19,288 So before we talk about why you would archive to get storage management, 544 00:27:19,288 --> 00:27:22,288 I think it's important, like you mentioned to talk about the cost. 545 00:27:22,528 --> 00:27:24,718 So production data, right? 546 00:27:24,718 --> 00:27:30,688 Sitting on tier one storage, it's very expensive, and as data ages typically 547 00:27:30,688 --> 00:27:33,298 the value of that data starts to reduce. 548 00:27:33,673 --> 00:27:38,503 So a project that you worked on three years ago, you're probably not gonna go 549 00:27:38,503 --> 00:27:41,023 back and touch it, think about it, right? 550 00:27:41,563 --> 00:27:44,983 But at the same time, you might have need to access it maybe at 551 00:27:44,983 --> 00:27:47,653 some point in time, or like the example Curtis you gave, right? 552 00:27:47,653 --> 00:27:50,863 It's a widget that you created no longer really needed. 553 00:27:50,868 --> 00:27:52,543 You don't need to keep all that data around. 554 00:27:52,543 --> 00:27:55,813 So you'll keep like the final version of the widget, but you don't need 555 00:27:55,813 --> 00:28:00,703 all the working copies and working examples that you created along the way. 556 00:28:00,703 --> 00:28:01,243 And so. 557 00:28:01,493 --> 00:28:03,053 You wanna save all that space. 558 00:28:03,053 --> 00:28:08,093 So what you could do is there are different solutions most people 559 00:28:08,093 --> 00:28:12,533 would go about and say, okay, let's archive this project and move it 560 00:28:12,533 --> 00:28:17,063 to cheaper lower cost storage that doesn't need that high performance. 561 00:28:17,573 --> 00:28:20,843 At the same time, allowing me to search and find it because that 562 00:28:20,843 --> 00:28:22,553 is critical for these use cases. 563 00:28:22,638 --> 00:28:27,528 So what people do is they would want to archive old data sets, things 564 00:28:27,528 --> 00:28:28,848 that they don't actively need. 565 00:28:28,908 --> 00:28:35,028 And so you move it off to a archive system that allows you to store at a much lower 566 00:28:35,028 --> 00:28:37,308 cost than the tier one production storage. 567 00:28:37,638 --> 00:28:40,938 And typically they give you this additional functionality like 568 00:28:40,938 --> 00:28:43,188 being able to do the searches that we had talked about before. 569 00:28:43,878 --> 00:28:48,198 Now one of the challenges with sort of archive systems, right, and moving 570 00:28:48,198 --> 00:28:51,348 the data is you have to be able to identify the data before you can move it. 571 00:28:52,308 --> 00:28:56,478 And for some organizations that's very difficult to do. 572 00:28:56,483 --> 00:29:00,288 And so you will see a lot of times where people are like, okay, I'm just gonna keep 573 00:29:00,288 --> 00:29:02,208 things on my primary tier one storage. 574 00:29:02,208 --> 00:29:05,598 But within that system they have other tiers of storage. 575 00:29:05,598 --> 00:29:08,268 Like I can move it off to, uh. 576 00:29:09,468 --> 00:29:15,618 Serial a, uh, a TA disc or I could move it to object storage and the storage 577 00:29:15,618 --> 00:29:18,948 array itself will automatically deal, deal with all that tiering for me. 578 00:29:18,948 --> 00:29:20,478 So I don't need to worry about it. 579 00:29:20,688 --> 00:29:24,498 It's still all seamless, but it is important to note that that's not archive. 580 00:29:25,188 --> 00:29:28,068 You don't get all the capabilities to be able to find your data. 581 00:29:28,158 --> 00:29:31,008 You don't have that protection necessarily to make sure a user 582 00:29:31,008 --> 00:29:32,838 doesn't go manually delete the data. 583 00:29:33,138 --> 00:29:36,438 You don't have that ability to search all copies of all the data. 584 00:29:37,023 --> 00:29:42,393 It's really more like a backup system that tries to emulate 585 00:29:42,393 --> 00:29:46,083 archive, which we've talked about before, is not an archive system. 586 00:29:46,803 --> 00:29:51,783 W. Curtis Preston: Yeah, I would describe, I mean, you know, you can, you can do, 587 00:29:52,083 --> 00:29:55,383 basically one of the things that people do is they maintain the same structure. 588 00:29:56,418 --> 00:29:57,798 Of what they have in the primary side. 589 00:29:58,158 --> 00:30:00,378 They just move it into a less expensive place. 590 00:30:00,378 --> 00:30:03,348 They move it from S3 to Glacier Deep Archive. 591 00:30:03,348 --> 00:30:03,738 Right. 592 00:30:04,218 --> 00:30:07,938 And you can, you can maintain the same structure and, and you're right, that's 593 00:30:07,938 --> 00:30:10,188 long-term retention that isn't archive. 594 00:30:10,758 --> 00:30:16,308 The idea behind archive is again, just like archive isn't backup long-term 595 00:30:16,308 --> 00:30:17,718 retention isn't archive either. 596 00:30:18,783 --> 00:30:25,053 And there are backup systems that just move old data, old backups out to long, 597 00:30:25,113 --> 00:30:27,303 you know, to less expensive storage. 598 00:30:27,753 --> 00:30:32,223 And if you actually need those backups, then it, it brings it back again. 599 00:30:32,223 --> 00:30:36,333 That's more kind of an HSM style thing than it is archive. 600 00:30:36,663 --> 00:30:39,573 That would be hierarchical storage management, for those of you that, 601 00:30:40,263 --> 00:30:41,913 that haven't used that term before. 602 00:30:42,633 --> 00:30:44,913 Um, but a true archive. 603 00:30:45,993 --> 00:30:50,133 Is going to allow you to bring it back in a different way. 604 00:30:50,133 --> 00:30:50,433 Right? 605 00:30:50,433 --> 00:30:55,173 So we talked about earlier, so this is sort of the most basic type of 606 00:30:55,173 --> 00:30:59,343 archive, is we, we do that search, we identify all of these files, all of 607 00:30:59,343 --> 00:31:03,753 the CAD drawings, all of the emails, all of the documents, all of the phone 608 00:31:03,753 --> 00:31:07,923 calls, all of the bi, you know what, all of the information having to do with 609 00:31:08,223 --> 00:31:11,883 the, um, you know, the Booyah widget. 610 00:31:13,773 --> 00:31:19,263 And then we archive that into a, uh, essentially a digital box. 611 00:31:19,263 --> 00:31:20,463 That's the way I like to call it. 612 00:31:21,003 --> 00:31:28,113 And we put all of it together so that when it's five years down the road and 613 00:31:28,113 --> 00:31:32,073 somebody says, you know, this reminds me a lot, this is one of the things we call, 614 00:31:32,073 --> 00:31:34,023 you know, institutional knowledge, right? 615 00:31:34,443 --> 00:31:38,403 This reminds me a lot of that thing Curtis was working on back in 2023. 616 00:31:38,403 --> 00:31:39,093 Remember that? 617 00:31:39,423 --> 00:31:40,053 What was it called? 618 00:31:40,053 --> 00:31:41,883 The Booya Project, right? 619 00:31:42,453 --> 00:31:46,803 And then you go to the archive system and you search on Booya and poof, 620 00:31:46,803 --> 00:31:50,673 there are all the emails, all the, you know, all the, um, whatever, all 621 00:31:50,673 --> 00:31:52,143 of this stuff having to do with this. 622 00:31:52,923 --> 00:31:58,233 I, one of the things I like to liken this to, have you ever watched a case, 623 00:31:58,293 --> 00:32:01,323 uh, an episode of the show, cold Case? 624 00:32:01,623 --> 00:32:02,463 You ever watch that? 625 00:32:03,813 --> 00:32:04,113 Okay, 626 00:32:04,188 --> 00:32:08,028 Prasanna: That's probably the one show like detective show that 627 00:32:08,028 --> 00:32:10,248 I've never seen or crime show. 628 00:32:11,073 --> 00:32:15,063 W. Curtis Preston: Yeah, so in cold case, every episode of Cold Case 629 00:32:15,063 --> 00:32:20,373 involves this warehouse where they have these boxes, you know those 630 00:32:20,373 --> 00:32:22,233 like off the kind of office type 631 00:32:22,308 --> 00:32:22,698 Prasanna: boxes? 632 00:32:22,698 --> 00:32:23,058 Yep. 633 00:32:23,493 --> 00:32:24,873 W. Curtis Preston: Yeah, the file folder boxes. 634 00:32:24,873 --> 00:32:25,203 Right. 635 00:32:25,563 --> 00:32:28,863 And um, and basically it's like. 636 00:32:29,238 --> 00:32:34,578 You know, Steve got murdered and there's a Steve murdered Steve box, right? 637 00:32:34,878 --> 00:32:38,598 And it'll say like, it'll have like date and time and basically they put 638 00:32:38,598 --> 00:32:41,748 all of the stuff, all of the evidence, all of the notes, all of the stuff, 639 00:32:41,748 --> 00:32:45,078 and they put that into a box and they put it on the cold case shelf. 640 00:32:45,468 --> 00:32:46,968 And then somebody's pulling that out. 641 00:32:46,973 --> 00:32:48,528 And again, they get all of the stuff. 642 00:32:48,828 --> 00:32:54,198 This is a digital version of that, so that when you remember and you say, um. 643 00:32:55,518 --> 00:32:58,128 Uh, you know, we want, we want to go back to that project, and 644 00:32:58,128 --> 00:32:59,898 I have a perfect example of this. 645 00:33:00,318 --> 00:33:06,198 I used to work for a, or I did some consulting work for a satellite 646 00:33:06,198 --> 00:33:11,928 company and that satellite company, once they, they used to make a lot of 647 00:33:11,933 --> 00:33:19,038 satellites for China, and then some time passed, some significant amount 648 00:33:19,038 --> 00:33:21,918 of time passed like several years. 649 00:33:23,448 --> 00:33:27,858 And then, uh, China came back and said, you, you remember that stuff 650 00:33:27,858 --> 00:33:30,378 that you made for us back in 1998? 651 00:33:30,558 --> 00:33:31,698 You remember those satellites? 652 00:33:32,028 --> 00:33:33,498 We want 20 more of them. 653 00:33:34,068 --> 00:33:35,388 We, we don't want any improvements. 654 00:33:35,388 --> 00:33:39,108 We just want, like, we want exactly the ones, those worked out really well. 655 00:33:39,108 --> 00:33:42,018 We want a, you know, we want a bunch of them, you know, we want 20 more. 656 00:33:42,678 --> 00:33:44,118 And they had an archive system. 657 00:33:44,118 --> 00:33:46,098 They were able to pull up all those drawings and then poof. 658 00:33:46,098 --> 00:33:50,478 And then just produce, uh, essentially carbon copies of what they made. 659 00:33:50,778 --> 00:33:51,708 That's. 660 00:33:52,188 --> 00:33:56,298 Sort of the old school archive and you, you need to be able to attach 661 00:33:56,298 --> 00:34:01,218 metadata to it, a project name, other things, so that when you're searching 662 00:34:01,218 --> 00:34:02,358 for it, you're able to find it. 663 00:34:02,448 --> 00:34:02,718 Prasanna: Yeah. 664 00:34:03,048 --> 00:34:05,898 Or another example is animation studios, right? 665 00:34:06,138 --> 00:34:09,288 Typically when you make a sequel, you're going back and pulling up old 666 00:34:09,288 --> 00:34:14,448 frames and old animations to reuse again, and so being able to quickly 667 00:34:14,448 --> 00:34:19,968 find those right and pull them back up saves your animators so much time 668 00:34:19,968 --> 00:34:21,408 rather than them trying to recreate it. 669 00:34:22,908 --> 00:34:23,658 W. Curtis Preston: Yeah, absolutely. 670 00:34:23,658 --> 00:34:28,578 And the other, uh, I, I know that w with, you know, we, we 671 00:34:28,578 --> 00:34:29,568 have some insight into that. 672 00:34:29,568 --> 00:34:33,418 We've had somebody on here, uh, who, who's, who's worked there, Jeff Rochlin. 673 00:34:33,978 --> 00:34:38,928 And, you know, we know that, that they do both sort of cloud versions. 674 00:34:38,928 --> 00:34:41,178 They also do like hard copy versions. 675 00:34:41,183 --> 00:34:42,378 They use optical media. 676 00:34:43,548 --> 00:34:46,008 Because they know they don't wanna lose it. 677 00:34:46,008 --> 00:34:46,188 Right? 678 00:34:46,188 --> 00:34:49,848 So they have multiple copies, so then they get back there. 679 00:34:50,718 --> 00:34:55,278 So that is one purpose of, uh, archive. 680 00:34:55,278 --> 00:34:58,578 But I, I'd say the more, do you agree with me that the more 681 00:34:58,583 --> 00:35:00,468 common reason is that e-discovery 682 00:35:00,708 --> 00:35:01,368 Prasanna: I think so. 683 00:35:01,758 --> 00:35:02,448 I think so. 684 00:35:03,393 --> 00:35:06,453 I think just going to storage management. 685 00:35:06,663 --> 00:35:10,233 I think a lot of people see storage management or storage costs as 686 00:35:10,533 --> 00:35:15,753 cheap enough not to hinder their users from moving the data and 687 00:35:15,753 --> 00:35:18,753 then them going, having to go and try to figure that all out. 688 00:35:18,753 --> 00:35:25,863 That I think it's not as big of a motivation motivator as it is from 689 00:35:25,863 --> 00:35:28,983 a compliance and e-discovery case. 690 00:35:29,238 --> 00:35:31,338 W. Curtis Preston: Being told, you know, you need to do that 691 00:35:32,118 --> 00:35:33,348 from a compliance standpoint. 692 00:35:33,918 --> 00:35:37,968 And so, and you touched on this a little bit earlier in that. 693 00:35:39,288 --> 00:35:43,728 You were saying that if people like create something and delete something, it would 694 00:35:43,728 --> 00:35:47,748 still be in the archive And, and I think that's an important distinction because 695 00:35:47,748 --> 00:35:50,058 we need to talk about the way this works. 696 00:35:50,478 --> 00:35:57,618 A basically, a real time archive system is the only way that's gonna happen because 697 00:35:57,618 --> 00:35:59,418 if you're just running batch archives. 698 00:36:00,168 --> 00:36:04,818 Let's say just in the same way we, we run batch backups at the end of the night. 699 00:36:05,658 --> 00:36:08,328 If you're just running batch archives, you wouldn't get those 700 00:36:08,328 --> 00:36:16,548 intermediate, uh, versions, uh, or, or files that, um, you know, emails. 701 00:36:16,548 --> 00:36:19,668 Like you, you, you might send an email and then you realize, oh, I said something. 702 00:36:20,148 --> 00:36:20,778 Prasanna: And go delete it. 703 00:36:21,093 --> 00:36:23,523 W. Curtis Preston: in that email, then you go delete the email. 704 00:36:23,823 --> 00:36:28,323 But if you have an actual email archiving system, it's watching and it's going to 705 00:36:28,323 --> 00:36:32,733 archive every single email that goes out and every single email that comes in. 706 00:36:33,468 --> 00:36:34,728 Prasanna: You know what this reminds me of? 707 00:36:35,463 --> 00:36:35,853 W. Curtis Preston: go ahead. 708 00:36:36,078 --> 00:36:38,838 Prasanna: This reminds me of our CDP discussions because this is 709 00:36:38,843 --> 00:36:43,008 literally what you want is you want CDP for an archive use case. 710 00:36:44,238 --> 00:36:45,198 W. Curtis Preston: Yeah, exactly. 711 00:36:45,198 --> 00:36:48,618 You are essentially doing, uh, that's a continuous data protection 712 00:36:48,618 --> 00:36:49,878 for those that missed that episode. 713 00:36:50,448 --> 00:36:57,318 And it is, you, you definitely want, um, sort of, you know, it's, it's real time. 714 00:36:57,323 --> 00:36:59,148 It can be it, it can be asynchronous, right? 715 00:36:59,153 --> 00:37:02,418 But it's real time replication of every single. 716 00:37:02,913 --> 00:37:05,943 Whatever it is that you're archiving, you do file system archiving. 717 00:37:05,973 --> 00:37:08,163 You would need to do file system archiving. 718 00:37:08,163 --> 00:37:14,223 You would need some sort of plugin to the file system to be notified of any 719 00:37:14,313 --> 00:37:18,273 file changes, which I would assume would be available from most filers. 720 00:37:18,543 --> 00:37:23,313 Like it would be something that you would plug into a virus detection program. 721 00:37:23,343 --> 00:37:23,733 Right, 722 00:37:25,368 --> 00:37:27,348 Prasanna: And it doesn't have to be every single change. 723 00:37:27,348 --> 00:37:29,958 It's only when those changes have been committed, right? 724 00:37:29,963 --> 00:37:30,648 So when you close 725 00:37:30,663 --> 00:37:31,293 W. Curtis Preston: right, right. 726 00:37:32,538 --> 00:37:32,868 Right. 727 00:37:33,468 --> 00:37:39,498 Um, and so the idea is that you would, uh, you, you're, you're 728 00:37:39,498 --> 00:37:43,878 storing that every single thing that goes out, both good and bad. 729 00:37:44,568 --> 00:37:51,678 And, um, and so, and when you have a, this is sort of, I would call this 730 00:37:51,678 --> 00:37:53,328 like a real archive system, right? 731 00:37:53,478 --> 00:37:57,348 So like it's, if it's four e discovery, you need to be able 732 00:37:57,348 --> 00:37:58,998 to go in there and there are. 733 00:38:00,288 --> 00:38:06,318 I don't know, 30, 40 different pieces of metadata attached to any particular 734 00:38:07,758 --> 00:38:10,128 item, object, whatever you wanna call it. 735 00:38:10,133 --> 00:38:10,398 Right? 736 00:38:10,398 --> 00:38:15,558 Obviously there, these include things like the author, the, if there's a, a document 737 00:38:15,558 --> 00:38:17,868 name or a subject name to an email. 738 00:38:18,528 --> 00:38:22,998 If there's, uh, if it's an email, who it was sent from, who it was sent to, 739 00:38:23,328 --> 00:38:29,358 the date it was sent, uh, the content of the email itself or the document itself. 740 00:38:30,198 --> 00:38:33,258 Um, what, what else, what can you think of other 741 00:38:33,408 --> 00:38:35,838 Prasanna: I was thinking like if it's a document that was shared, 742 00:38:35,838 --> 00:38:37,428 like who else it was shared with. 743 00:38:37,923 --> 00:38:38,973 Who had access? 744 00:38:38,973 --> 00:38:40,383 When they had access? 745 00:38:41,073 --> 00:38:42,063 Who left comments? 746 00:38:42,063 --> 00:38:43,203 Who made updates? 747 00:38:44,628 --> 00:38:44,988 W. Curtis Preston: Right. 748 00:38:44,988 --> 00:38:49,038 All of that stuff would be shared or stored in a realtime, you know, in a 749 00:38:49,038 --> 00:38:54,228 realtime archive system so that you can say, I wanna see all the documents 750 00:38:54,233 --> 00:38:57,978 that Curtis created, and I wanna see everybody that saw those documents. 751 00:38:57,978 --> 00:38:58,248 Right? 752 00:38:58,248 --> 00:39:03,858 So, so you can search by, you know, document owner, document creator, 753 00:39:04,218 --> 00:39:08,598 uh, email owner and creator, and, um. 754 00:39:09,963 --> 00:39:15,963 Let's say you have an employee who has, uh, accused a company of a hostile 755 00:39:15,963 --> 00:39:20,283 work environment, and they say, uh, I got all these emails from all kinds 756 00:39:20,283 --> 00:39:22,143 of people saying all kinds of things. 757 00:39:22,653 --> 00:39:26,853 Okay, well, show me all the emails that were sent to this person. 758 00:39:27,453 --> 00:39:28,953 Over the time that they worked here. 759 00:39:29,493 --> 00:39:32,613 And then we're gonna, and then we'll do calling again, right? 760 00:39:32,973 --> 00:39:36,423 We'll go in and we'll do, we'll do one big search to pull and just get 761 00:39:36,423 --> 00:39:40,893 a giant pile of emails, all of the emails that were sent to this person. 762 00:39:41,613 --> 00:39:45,723 And then we go in and we search for phrases and words. 763 00:39:46,083 --> 00:39:48,663 Uh, that should not be in a business email. 764 00:39:49,203 --> 00:39:49,983 Um. 765 00:39:50,343 --> 00:39:54,633 And so that's why it's, that's why it's a two step phrase or a two step 766 00:39:54,633 --> 00:40:01,203 process, not, you don't want to do 10 e-discovery polls against the, the email. 767 00:40:01,953 --> 00:40:08,558 Um, so why don't we, um, why don't we do this with a backup system? 768 00:40:09,858 --> 00:40:14,388 Prasanna: because backup serves a different purpose, right? 769 00:40:14,388 --> 00:40:17,133 It's intended to restore data, not retrieve data. 770 00:40:18,693 --> 00:40:23,703 And there are some systems that try to do this and mix the two 771 00:40:23,703 --> 00:40:26,253 W. Curtis Preston: Probably the one that comes to my mind the 772 00:40:26,253 --> 00:40:28,353 most would be CommVault, right? 773 00:40:28,353 --> 00:40:31,623 They have a common technology engine between backup and archive. 774 00:40:32,403 --> 00:40:35,403 Um, I don't, and I, and I'm not saying this at like, I. 775 00:40:35,973 --> 00:40:38,343 I'm not saying that they don't do it, I just, I haven't 776 00:40:38,343 --> 00:40:40,083 spoken to anyone who does both. 777 00:40:40,713 --> 00:40:44,883 Theoretically it could be done with a single system and they do claim 778 00:40:44,883 --> 00:40:46,143 to do it with a single system. 779 00:40:46,353 --> 00:40:48,243 I just don't know anybody that does that. 780 00:40:48,423 --> 00:40:52,053 Uh, I'd love to hear from anybody that is using either Commvault or 781 00:40:53,163 --> 00:40:58,083 anything else that is doing both backup and archive with a single system. 782 00:40:58,323 --> 00:41:01,863 Again, it's, it's, it's theoretically possible, but generally speaking, 783 00:41:01,868 --> 00:41:03,873 backup systems don't store the data. 784 00:41:04,908 --> 00:41:09,588 In a way that, um, you, you can't search against it like that. 785 00:41:09,918 --> 00:41:12,078 The, the first thing a backup system is want to, okay. 786 00:41:12,078 --> 00:41:13,308 What system are you restoring? 787 00:41:14,328 --> 00:41:15,978 Uh, I don't know. 788 00:41:16,128 --> 00:41:16,578 Right. 789 00:41:16,818 --> 00:41:18,978 I'm just looking for emails. 790 00:41:19,098 --> 00:41:20,478 Oh, so you wanna restore the email server? 791 00:41:20,478 --> 00:41:21,528 What's the email server's name? 792 00:41:21,943 --> 00:41:23,838 Uh, I don't know. 793 00:41:23,838 --> 00:41:24,828 It was five years ago. 794 00:41:24,888 --> 00:41:25,278 I don't know. 795 00:41:26,778 --> 00:41:32,658 Um, and, uh, you know, part of the way we were on, we were on, uh, Google, uh, email 796 00:41:32,658 --> 00:41:38,358 and then we switched over to Microsoft 365 and then we were, you know, um, a 797 00:41:38,358 --> 00:41:41,778 good email system would have all of the email from all of those, regardless of 798 00:41:41,778 --> 00:41:42,933 which hosting provider you were using. 799 00:41:43,488 --> 00:41:47,598 Prasanna: The other thing also is that for a lot of these use cases, it's also 800 00:41:47,598 --> 00:41:51,348 that full text search index, right? 801 00:41:51,348 --> 00:41:57,288 To be able to find not many backup products can do the full text 802 00:41:57,288 --> 00:42:02,628 search across all your different data sets and data types, right? 803 00:42:02,633 --> 00:42:08,238 There are e-discovery products that allow you to search what people said in a video. 804 00:42:08,913 --> 00:42:12,453 And show that as, Hey, who was Curtis talking to in this 805 00:42:12,453 --> 00:42:13,833 meeting that got recorded? 806 00:42:13,833 --> 00:42:16,773 And be able to pull up the phrases and look at the transcripts. 807 00:42:18,888 --> 00:42:21,918 W. Curtis Preston: Yeah, that is a a really good point. 808 00:42:22,128 --> 00:42:26,208 There are some limited backup systems that are able to restore a 809 00:42:26,208 --> 00:42:28,728 file based on its full text, right? 810 00:42:28,728 --> 00:42:31,488 You can search against the full text of a file, but again, you're 811 00:42:31,488 --> 00:42:32,958 gonna find one file, right? 812 00:42:33,658 --> 00:42:37,978 Um, the, and again, generally speaking, you start with the system you're 813 00:42:37,978 --> 00:42:43,498 restoring and then you, and then you, uh, call if you will from there. 814 00:42:43,948 --> 00:42:47,248 Whereas this, this is casting an archive system is catching a 815 00:42:47,248 --> 00:42:50,008 much, casting a much wider net. 816 00:42:50,518 --> 00:42:53,073 Prasanna: The one question I had for you, Curtis, is 817 00:42:53,428 --> 00:42:53,698 W. Curtis Preston: Yeah. 818 00:42:54,243 --> 00:42:57,663 Prasanna: typically who operates the archive system versus who 819 00:42:57,663 --> 00:42:58,983 operates the backup system? 820 00:43:00,618 --> 00:43:02,838 W. Curtis Preston: Well, it's going to, the answer to that 821 00:43:02,843 --> 00:43:05,718 question will be de will depend on. 822 00:43:06,363 --> 00:43:09,723 Whether we did this for storage management purposes or free discovery 823 00:43:09,723 --> 00:43:13,653 purposes, if we're doing it for storage management purposes, uh, it 824 00:43:13,653 --> 00:43:15,483 can be just about anybody, right? 825 00:43:15,488 --> 00:43:17,223 That is qualified to operate it. 826 00:43:17,673 --> 00:43:22,683 But if we're doing it for e-discovery purposes or compliance purposes, it's 827 00:43:22,683 --> 00:43:27,783 going to be someone that is specifically trained in compliance and to make sure 828 00:43:27,783 --> 00:43:31,623 that they have the right requirements to make sure that you have both the. 829 00:43:33,033 --> 00:43:38,043 The initial creation of the archive and then the retention of the archive because 830 00:43:38,313 --> 00:43:41,433 there may actually be laws and rules on. 831 00:43:42,948 --> 00:43:48,768 How long you can re uh, actually retain certain amounts of data. 832 00:43:49,278 --> 00:43:53,958 And you may be told, uh, for whatever reason, a legal reason. 833 00:43:54,108 --> 00:43:57,018 There's certainly the legal hold reason to, you have to keep this 834 00:43:57,018 --> 00:44:02,508 data, but there may also be a legal reason why, where you're told to 835 00:44:02,778 --> 00:44:04,698 get rid of a certain set of data. 836 00:44:04,698 --> 00:44:06,468 I can think of things like GDPR. 837 00:44:06,938 --> 00:44:12,218 Most of the time in the case of GDPR, for example, and CCPA, if you have a business 838 00:44:12,218 --> 00:44:14,588 reason to hold that data, you, you can. 839 00:44:15,038 --> 00:44:21,188 But there still may be a scenario where you're told that you need to, um, you 840 00:44:21,193 --> 00:44:22,748 know, get rid of a certain set of data. 841 00:44:22,748 --> 00:44:31,658 And this is all very specific, um, compliance related things that. 842 00:44:31,998 --> 00:44:36,228 You and I and people that think like you, and I don't necessarily think 843 00:44:36,233 --> 00:44:38,628 about, uh, on a day-to-day basis. 844 00:44:40,848 --> 00:44:44,508 Prasanna: No, I think that's important because that just goes back to why backup 845 00:44:44,508 --> 00:44:48,888 and archive systems may not come together is because they are different teams 846 00:44:51,633 --> 00:44:51,923 W. Curtis Preston: Yeah. 847 00:44:52,723 --> 00:44:52,843 I. 848 00:44:53,298 --> 00:44:57,198 Yeah, a backup person, you know, a storage management person, a, a 849 00:44:57,198 --> 00:45:01,608 typical system administrator, can handle the u the a backup system. 850 00:45:02,328 --> 00:45:06,438 They quite possibly are not qualified to handle a full, uh, archive 851 00:45:06,438 --> 00:45:09,678 system, especially if it's one that's done for compliance purposes. 852 00:45:10,738 --> 00:45:15,628 aNd I'll just, I'll just end this with telling my favorite. 853 00:45:16,513 --> 00:45:21,463 Here's what can happen if you need an email archive and you don't have one. 854 00:45:22,483 --> 00:45:24,733 Uh, I worked for a consulting company. 855 00:45:24,793 --> 00:45:29,113 It was a big consulting company that had, I don't know, they had like a few 856 00:45:29,113 --> 00:45:36,673 hundred, uh, consultants and we were hired by, um, a actually have two stories. 857 00:45:37,088 --> 00:45:39,223 Prasanna: I, I, I, I think I know which story you're going to go to. 858 00:45:39,223 --> 00:45:39,493 Yeah. 859 00:45:40,123 --> 00:45:44,053 W. Curtis Preston: we were hired by a company that. 860 00:45:44,953 --> 00:45:45,313 Needed. 861 00:45:45,343 --> 00:45:48,073 They got, they got an e-discovery against their email, and what 862 00:45:48,073 --> 00:45:53,023 they had was a weekly full backup from their, uh, email in exchange. 863 00:45:53,143 --> 00:45:57,913 And we, basically, what that meant was because they, they 864 00:45:57,913 --> 00:45:58,903 just had a weekly backup. 865 00:45:58,908 --> 00:45:59,833 They didn't have an archive. 866 00:46:00,313 --> 00:46:04,993 It ended up costing them well over a million dollars in consulting 867 00:46:04,993 --> 00:46:10,123 time because we needed like this team of like 15 people. 868 00:46:10,123 --> 00:46:12,583 It was like a three teams of five that were working. 869 00:46:13,138 --> 00:46:18,508 24 hours a day, um, to, to be able to do these. 870 00:46:18,988 --> 00:46:23,848 Because what it meant was you restore, exchange to this week, extract the 871 00:46:23,848 --> 00:46:27,388 stuff you want, then you wipe that and you restore it to next week. 872 00:46:27,393 --> 00:46:30,508 And it was just this very, very, uh, difficult process. 873 00:46:30,958 --> 00:46:33,838 But the other one is this famous case. 874 00:46:34,633 --> 00:46:37,453 And I don't wanna say the company because of what, I don't wanna 875 00:46:37,453 --> 00:46:41,203 get the company wrong, but it was a large financial trading firm. 876 00:46:41,863 --> 00:46:51,223 And the, what happened was it became infamous because they, they 877 00:46:51,228 --> 00:46:52,723 didn't have an email archive system. 878 00:46:52,723 --> 00:46:55,723 They had backup system and, and it wasn't well maintained. 879 00:46:55,723 --> 00:46:58,993 And they, they changed things over time and so it took 880 00:46:58,993 --> 00:47:02,383 them forever to satisfy the. 881 00:47:03,448 --> 00:47:08,668 The electronic discovery request to get the emails that, that the 882 00:47:08,938 --> 00:47:11,488 plaintiff in this case was looking for. 883 00:47:12,148 --> 00:47:16,103 And then at some point you then tell the judge I. 884 00:47:16,663 --> 00:47:17,293 We're done. 885 00:47:17,323 --> 00:47:20,353 We, we, we, you know, we've satisfied the discovery request. 886 00:47:20,653 --> 00:47:23,713 And then a little bit later they came back and they're like, sorry, judge. 887 00:47:23,773 --> 00:47:25,753 Uh, we found this other box of tape. 888 00:47:26,293 --> 00:47:26,653 Right? 889 00:47:27,463 --> 00:47:31,093 And at that point, it had already gone on a really long time. 890 00:47:31,098 --> 00:47:32,833 And then they'd said they were done and then they, it 891 00:47:32,838 --> 00:47:33,823 turned out they weren't done. 892 00:47:34,153 --> 00:47:35,443 The judge ended up. 893 00:47:35,998 --> 00:47:41,608 Issuing what's called an adverse inference instruction, where where 894 00:47:41,848 --> 00:47:44,638 they said basically whatever. 895 00:47:44,908 --> 00:47:50,398 What it is, is it's an instruction from the judge that infers something 896 00:47:50,608 --> 00:47:54,388 that is adverse to your case, hence the term adverse inference instruction. 897 00:47:55,408 --> 00:48:01,678 So they basically said whatever the plaintiff says is on the tapes. 898 00:48:02,023 --> 00:48:06,493 It's on the tapes because no one could possibly be this 899 00:48:06,493 --> 00:48:09,343 bad at retrieving their data. 900 00:48:09,703 --> 00:48:11,893 And so they must be doing it on purpose. 901 00:48:12,043 --> 00:48:17,643 They're trying to hide something and boom, they lost a, it was like two billion 902 00:48:17,643 --> 00:48:21,783 dollar lawsuit as a result of simply not having an email archive system. 903 00:48:22,033 --> 00:48:24,403 W. Curtis Preston (2): Since recording this episode a month ago, 904 00:48:24,403 --> 00:48:28,603 I actually learned about an 11 year old company that is built a nice 905 00:48:28,603 --> 00:48:31,003 business that among other things. 906 00:48:31,273 --> 00:48:35,623 Helps companies who used their backup systems as archive systems. 907 00:48:35,653 --> 00:48:37,873 You know, the thing I tell you not to do. 908 00:48:38,143 --> 00:48:41,443 So if you're trying to do e-discovery using your old backup tapes, 909 00:48:41,623 --> 00:48:46,033 they'll do it for you as a service, saving you time and money on the 910 00:48:46,033 --> 00:48:47,773 extraction and calling phases. 911 00:48:48,103 --> 00:48:51,733 And reducing the amount of data that you have to give, whatever 912 00:48:51,763 --> 00:48:53,953 e-discovery system that you're using. 913 00:48:54,373 --> 00:48:56,653 All of those charged by the gigabytes. 914 00:48:56,653 --> 00:49:00,103 So everything you can reduce there is, you know, goes in your favor. 915 00:49:00,673 --> 00:49:04,783 They also have a service to significantly reduce, remove your iron mountain 916 00:49:04,783 --> 00:49:09,253 bill while allowing you to search against any of those tapes at any time. 917 00:49:09,343 --> 00:49:11,593 They call it the intelligent tape archive. 918 00:49:11,636 --> 00:49:15,476 Also for those of you using Dell source one archive system. 919 00:49:15,746 --> 00:49:17,306 That they are sundowning. 920 00:49:17,786 --> 00:49:19,766 They've got a service for that as well. 921 00:49:19,766 --> 00:49:23,846 They can directly extract cull and store that for you as well. 922 00:49:24,546 --> 00:49:27,756 There are a very impressive company that really understands the 923 00:49:27,756 --> 00:49:29,946 litigation and e-discovery worlds. 924 00:49:30,276 --> 00:49:34,476 And they really surprised me with how easily they're able to extract 925 00:49:34,476 --> 00:49:38,916 data directly from backup tapes without needing the original software. 926 00:49:38,946 --> 00:49:41,976 Even if you managed to encrypt your backup tapes. 927 00:49:42,396 --> 00:49:45,996 Their name is Sullivan Strickler and I'll put a link in the show notes. 928 00:49:46,206 --> 00:49:47,496 Uh, in case you're interested. 929 00:49:47,820 --> 00:49:51,620 W. Curtis Preston: So if you have the need for it, if you have a compliance reason. 930 00:49:52,560 --> 00:49:55,590 Or you have other business reasons we gave you some in the early, you know, 931 00:49:55,590 --> 00:49:59,220 this idea of do you, do you want to track who made what, you know, who 932 00:49:59,220 --> 00:50:02,730 made what, when, in case you, you know, want to be able to sue them later? 933 00:50:04,110 --> 00:50:10,200 Um, just realize a good archive is a double-edged sword in that 934 00:50:10,260 --> 00:50:12,570 if you were doing something wrong. 935 00:50:13,163 --> 00:50:14,723 It is the smoking gun. 936 00:50:15,803 --> 00:50:18,953 And you, you know, uh, it will show everything that you were 937 00:50:18,953 --> 00:50:22,793 saying, uh, to, to whom and when, and, you know, all this stuff. 938 00:50:23,093 --> 00:50:28,393 So a good email archive is really only helpful if you are. 939 00:50:28,798 --> 00:50:32,218 The type of company that does that, does the right thing. 940 00:50:32,773 --> 00:50:36,268 But, but if you've got somebody in your company that's doing the wrong 941 00:50:36,268 --> 00:50:39,148 thing, the email archive will prove that and you'll lose your case. 942 00:50:39,148 --> 00:50:41,368 But honestly, uh, maybe you should anyway. 943 00:50:41,938 --> 00:50:46,438 But, but here's the thing, if you are doing the right thing, a bad, like 944 00:50:46,438 --> 00:50:51,178 using your backup system as the archive system, it can actually do you much 945 00:50:51,178 --> 00:50:55,558 more damage than, uh, you could have trouble proving that you were right. 946 00:50:55,588 --> 00:50:57,658 Even if you were, even if you were right. 947 00:50:58,378 --> 00:50:59,908 And your company did nothing wrong. 948 00:51:00,169 --> 00:51:01,789 Uh, you could lose the lawsuit. 949 00:51:02,339 --> 00:51:03,179 Any final thoughts? 950 00:51:03,614 --> 00:51:05,624 Prasanna: no, I think that's, yep. 951 00:51:06,554 --> 00:51:08,834 Backup is not archive and archive is not backup. 952 00:51:10,289 --> 00:51:13,169 W. Curtis Preston: Yeah, and there are two different types of archive, right? 953 00:51:13,169 --> 00:51:16,829 There's sort of the storage management reason and there's the real time. 954 00:51:17,999 --> 00:51:23,249 System that is for compliance reasons that make sure that you get a every copy 955 00:51:23,249 --> 00:51:27,779 of everything that you can search against it, uh, for the purposes of eDiscovery. 956 00:51:27,809 --> 00:51:32,999 And if you need that type, then uh, you'd better buy that type. 957 00:51:33,239 --> 00:51:36,479 Because if you ever actually need it, you're really gonna 958 00:51:36,509 --> 00:51:37,529 want that functionality. 959 00:51:38,109 --> 00:51:38,529 All right. 960 00:51:38,529 --> 00:51:41,229 Hopefully that's helped with your questions about archive. 961 00:51:41,469 --> 00:51:42,489 Thanks for joining. 962 00:51:42,849 --> 00:51:44,229 That is a wrap. 963 00:51:47,272 --> 00:51:51,952 The backup wrap up is written, recorded and produced by me w Curtis Preston. 964 00:51:52,522 --> 00:51:53,992 If you need backup or Dr. 965 00:51:53,992 --> 00:51:57,622 Consulting content generation or expert witness work, 966 00:51:57,922 --> 00:51:59,872 check out backup central.com. 967 00:52:00,622 --> 00:52:03,772 You can also find links from my O'Reilly Books on the same website. 968 00:52:04,402 --> 00:52:08,512 Remember, this is an independent podcast and any opinions that you 969 00:52:08,512 --> 00:52:10,402 hear are those of the speaker. 970 00:52:10,467 --> 00:52:12,327 And not necessarily an employer. 971 00:52:13,227 --> 00:52:13,947 Thanks for listening.