We helped a customer last week who believed that his data was being safely backed up to his Apple iCloud drive when in fact his Mac was performing a phantom backup.
Let me explain. Our customer discovered that the 2.5” hard disk (HGST Z5K-500) inside his MacBook Pro had failed. Believing that iCloud had his back covered, he logged into his iCloud Drive and reassuringly saw the whole folder structure of his failed disk. But to his horror, when he clicked on these folders most of them were empty. The folders were there, but the files were not at home… It transpired that iCloud, whilst giving the impression of a complete disk sync had just synced the folder structure of his disk.
Stored on his iCloud account were – what only can be described – as “Phantom Backups”, empty shell folders created by the iCloud application, which merely gave the illusion of backup. And this is a surprisingly common problem.
The Cause of Phantom Backups
There are a number of reasons why phantom backups get created. First of all, from a software development perspective, online syncing or back-up from an endpoint device such as a laptop to a remote (cloud) server is actually quite a delicate process. The backup or syncing application must get deep support from the operating system to function. It must then replicate the folder structure of the source disk. Then, it must transfer data using data packets of a reasonable size. Then, the app must decide correctly, which files have changed since the last sync or backup. This whole process is dependent on a good quality, stable internet connection with a reasonable upload speed. And for the whole process to complete successfully – it is preferable that the user does not max out their upstream bandwidth by simultaneously uploading boxsets onto P2P sites, letting their battery run flat or turning off their system mid-sync. So, that’s a lot of boxes to be ticked.
Don’t get fooled by a Data Mirages
However, even if this process fails a user can still log in to their iCloud, One Drive, Amazon Drive etc. account and will probably see what looks like a backup of their files. On the surface, the folder structure will all be there which looks very reassuring. But, like a parched trekker in the the desert discovering that the apparent spring ahead of them is a mirage, discovering after a data loss event, empty folders on a cloud server can be just as gut-wrenching.
How do Phantom Backups Happen?
Well, one of the first functions an online sync or backup app will perform will be the re-creation of the folder structure as selected by the user. This might be just a few folders and sometimes it can be a whole disk. Once the folder structure is in place, the application will try to populate these folders with data. But here’s the rub, even if something does go askew during this process, the whole folder structure will appear to the user anyway, even if it is just a pile of shell folders.
Preventing Phantom Backups
The importance of backup verification cannot be stressed enough. Dropbox does this very well. They use a tiny green dot above the folder on the source device to indicate a successful sync. Other backup providers use less slick means like sending the user an email confirmation of backup which is nice but unless it has a complete file listing could be misleading. And of course, there is always the manual “eyeball” verification method where the user can physically log in to the cloud server and inspect their files. And more importantly, using this strategy the user should pick folders at random, drilling down while checking for file completeness and integrity.
It could be construed from this blog post that syncing is a form of backup – it’s not. Yes, it’s better than nothing, but if you’re using a syncing application as a sole backup means – it really needs to be complemented with another (preferably) isolated backup medium. Remember syncing applications can be pretty lousy at protecting your data from sabotage, ransomware or accidental deletion. But that topic alone merits another blog post.
Drive Rescue Data Recovery is based in Dublin, Ireland. We offer an Apple data recovery service for MacBook, MacBook Pro, MacBook Air and Mac Mini devices along with iMacs. Find out more at: www.datarecoverydublin.ie