# Backup and recovery

> CIE A-Level Computer Science · 9618 (2024-2026)
> Source: https://www.owlsprep.com/study/cie-9618-u6-backup-and-recovery/

This sub-topic explores the purpose of backups, common backup types, recovery processes, and appropriate strategies to protect data from loss, corruption, and disaster, aligned to CIE A-Level 9618 requirements.

**Prerequisites:** [Data integrity and security threats](https://www.owlsprep.com/study/cie-9618-u6-data-integrity-threats/)

## Learning objectives

- Explain the purpose of backups in maintaining data integrity
- Differentiate between full, incremental and differential backup types
- Describe the end-to-end recovery process for different backup types
- Recommend appropriate backup strategies for specific scenarios

## 1. Purpose of Backups

**Backup** — A duplicate copy of current organizational or personal data, stored separately from the original production data, created to restore data after an incident that causes data loss or corruption.

*Example:* A retail store backing up daily transaction data to an off-site server.

Backups protect against multiple common causes of data loss, including human error (accidental deletion), hardware failure (hard drive crashes), malware (ransomware encryption), and physical disasters (fire, flood destroying on-site hardware).

- Maintain business continuity after data loss: prevents extended downtime that causes revenue loss
- Preserve data integrity by allowing restoration to a known uncorrupted state
- Comply with legal and regulatory requirements for data retention
- Protect against irreversible damage from ransomware attacks

**Worked example:** A small business asks why they need a backup if they already store all data on Google Drive. What is the core reason?

1. Recognize that cloud storage is primary storage, not a backup.
2. Cloud storage only hosts one copy of active data. If data is accidentally deleted or corrupted, the change syncs across all connected devices, leaving no intact copy to recover.
3. A separate independent backup stores a copy of data from before the corruption or deletion occurred, enabling recovery.
4. A separate backup is required to recover data lost or corrupted in the primary cloud storage.

> **Exam tip:** In scenario questions, always link your recommended backup strategy to the specific risks described in the question.

## 2. Common Backup Types

Backups are categorized by how much data they copy each time they run. The three core types tested in CIE 9618 are full, incremental, and differential backups.

| Backup Type | What it copies | Backup speed | Storage size | Recovery speed |
| --- | --- | --- | --- | --- |
| Full | All selected data | Slow | Large | Fast (1 file needed) |
| Incremental | Changes since last backup (any type) | Very fast | Small | Slow (needs all backups since last full) |
| Differential | All changes since last full backup | Moderate (grows over time) | Moderate (grows over time) | Fast (only needs full + last differential) |

> **Memory Hook**
>
> Incremental = Incremental (adds a little each step), Differential = Difference from the start (last full backup)

**Worked example:** An organisation runs a full backup every Sunday, and incremental backups every other weekday. If data is lost on Thursday, how many backup files are needed for full recovery?

1. Recall that incremental backups only store changes since the last backup of any type.
2. Start with the base full backup from Sunday (1 file)
3. Add the incremental backup from Monday (changes since Sunday, 2nd file)
4. Add the incremental backup from Tuesday (changes since Monday, 3rd file)
5. Add the incremental backup from Wednesday (changes since Tuesday, 4th file)
6. Total of 4 backup files are required for full recovery.

*Calculator:* forbidden

## 3. Backup Storage & Disaster Recovery

How and where you store backups is just as critical as the backup type for their effectiveness. Storage location is split into on-site and off-site, each with different use cases.

**Disaster Recovery Plan (DRP)** — A documented set of procedures to recover critical data and IT systems after a major disruptive incident, such as a natural disaster, large-scale cyberattack, or infrastructure failure.

*Example:* A hospital's DRP that requires full patient record recovery within 4 hours of a server outage.

On-site backups are stored at the same location as the original data, enabling fast access for quick recovery from common issues like accidental deletion. However, they are vulnerable to site-wide disasters that destroy all on-site infrastructure. Off-site backups are stored at a geographically separate location, protecting against site-wide disasters, with cloud backup being a common modern option.

**Worked example:** A small local law firm wants to protect client data against both accidental deletion and a fire that destroys their office. Recommend an appropriate backup storage strategy.

1. Address the first risk (accidental deletion): on-site backups allow fast recovery for small, common incidents.
2. Address the second risk (office fire): an on-site backup will be destroyed along with the original data, so a separate off-site backup is required.
3. Final recommendation: Combine daily incremental on-site backups for quick small-scale recovery, with a weekly encrypted full backup stored on an off-site cloud service. This balances speed for small incidents and protection against large disasters.

*Calculator:* forbidden

## 4. The Backup Recovery Process

Recovery is the process of restoring data from backups after loss or corruption. The exact steps depend on the backup type used, but follow a standard general workflow:

1. Identify the cause of data loss and confirm the point in time to restore to
2. Verify the integrity of backup files to ensure they are uncorrupted
3. Restore the base full backup to the target system
4. Apply any subsequent incremental or differential backups in order
5. Verify the restored data and bring the system back online

**Exam command terms**

Common command terms in CIE 9618 for this topic have clear expectations:

- **Distinguish** — Clearly state the difference between two concepts, covering both creation and recovery *(When distinguishing incremental vs differential backup, you must mention how recovery differs, not just how the backup is created)*

- **Recommend** — Justify your choice of strategy by linking it to the specific requirements in the scenario

**Worked example:** Describe the recovery process for data lost on Thursday, when a full backup is taken every Sunday and a differential backup every Wednesday.

1. Confirm the restore point: after Wednesday's changes, before Thursday's data loss
2. First restore the full base backup from Sunday to the target system
3. Apply the most recent differential backup from Wednesday, which contains all changes made since Sunday
4. Verify the restored data is complete and uncorrupted, then bring the system back online
5. Only 2 backup files are needed for full recovery, compared to 4 for incremental backups in the same scenario

*Calculator:* forbidden

## Common pitfalls

- **Wrong:** Confusing incremental and differential backups: stating incremental stores changes since the last full backup
  - Why it fails: This mixes up the two types, leading to wrong answers for recovery file count questions
  - Correct: Incremental = changes since *any last backup*, differential = changes since *last full backup*
- **Wrong:** Assuming primary cloud storage is a complete backup solution
  - Why it fails: Cloud storage only stores one copy of active data, so corrupted/deleted data is synced across all devices
  - Correct: Always recommend a separate independent backup even for cloud-hosted primary data
- **Wrong:** Storing all backups on-site for disaster protection
  - Why it fails: A site-wide disaster like fire or flood will destroy both original and backup data
  - Correct: Always use a geographically separate off-site backup for disaster protection
- **Wrong:** Forgetting to verify backup or restored data integrity
  - Why it fails: Backups can become corrupted just like primary data, so an unverified backup cannot be trusted
  - Correct: Always include verification of backup integrity before storage and restored data after recovery
- **Wrong:** Claiming archives are the same as backups
  - Why it fails: Archives serve a different purpose than backups for data protection
  - Correct: Backups are for active recovery of current data; archives are for long-term retention of inactive data

## Cheatsheet

| Property | Full Backup | Incremental | Differential |
| --- | --- | --- | --- |
| What it copies | All selected data | Changes since last backup | Changes since last full |
| Backup speed | Slow | Fastest | Moderate |
| Total storage size | Largest | Smallest | Grows over time |
| Recovery speed | Fastest | Slowest | Fast |
| Files needed (full Sun, backups Mon-Wed, loss Thu) | 1 | 4 | 2 |

## What's next

Backup and recovery is a core component of data integrity and organizational cyber security, regularly tested in both paper 1 multiple choice and paper 2 scenario-based questions for CIE 9618. Mastery of this topic supports understanding of larger concepts like disaster recovery and business continuity, which are often paired with other security topics in exams. This topic also links closely to legal compliance requirements for data retention, and to understanding how organizations mitigate common cyber security threats.

- [Data Integrity Concepts](https://www.owlsprep.com/study/cie-9618-u6-data-integrity/)
- [Ethics & ownership](https://www.owlsprep.com/study/cie-9618-u7-overview/)
- [Ethical issues](https://www.owlsprep.com/study/cie-9618-u7-ethical-issues/)

---

From [OwlsPrep](https://www.owlsprep.com) — free study guides for A-Level, IB, AP and IGCSE, written against the official syllabus. Canonical page: https://www.owlsprep.com/study/cie-9618-u6-backup-and-recovery/