Everything BeBackup does 7

What BeBackup protects

• Files and folders, local paths and UNC network shares, with encrypted credentials
• Automatic enumeration of the shares on a machine or a domain
• Whole disks and partitions, as a block-by-block image or as BeBackup SmartImage® v7
• Microsoft SQL Server, database by database, through VSS
• Hyper-V virtual machines, VM by VM
• System state: Active Directory, registry, certificates and other VSS writers
• VMware ESXi virtual machines, backed up from the host
• Microsoft 365: mail, contacts, calendars, tasks, OneDrive, SharePoint v7

System, databases and virtualisation in detail

The backup engine

• Block-level incremental: the server states which blocks changed, and only those travel
• LZO compression then AES-256 encryption on the workstation, before sending
• NTFS USN journal for incremental analysis, with a persistent resume point
• Detection of files held open that neither the date nor the USN journal reports
• ADS alternate streams, EFS files, NTFS-compressed, sparse, ACLs: preserved exactly
• MD5, CRC32 and SHA-256 hashes per file, MD5 per block
• Automatic resume after a network outage, mid-transfer
• Bandwidth limiting by day, time range and direction of traffic

Encryption and transport in detail

Restoring

• A file or a folder, at the date you choose, to its original location or elsewhere
• Search within backups, deduplication on restore
• A partition, a whole disk, the partition table, with a detailed restore plan
• 4Kn disks, with logical partition chaining recomputed
• Restore to a VHDX file instead of a physical disk
• A physical or virtual machine to a VMware ESXi VM (P2V, V2V) v7
• A WinPE environment for a machine that no longer boots
• Everything is driven from the browser, without logging on to the workstation

Every recovery scenario

The server: storage, versions, retention

• A storage format of our own: 512 KB blocks, allocation table, configurable clusters
• Per-file versioning with block-level delta between versions
• Deduplication: identical content already present is not written again
• Advanced tiered retention: day, week, month, year, minimum number of versions v7
• Retention simulation: see what would be kept or deleted, and why, before applying v7
• Integrity check by re-reading and comparing hashes, scheduled or on demand
• Every block carries its own hashes: the server verifies without holding the key
• Multiple storage locations, local or UNC, assignable by provider or by company

Replication and multiple sites

• Replication of a medium to one or more other BeBackup servers
• Inheritable rules per medium, with retry on failure
• Linked servers: synchronised administration database, mutual certificate authentication
• Fine-grained permission per server: back up, restore, replicate
• Not-started alerts query the linked servers before raising anything
• The off-site copy runs server to server, without going back through client workstations

Multi-client administration

• A hierarchy of providers, companies, users and media, with cascading inheritance
• Around fifty named rights per reseller user
• White label per provider: name, URL, logo
• Quotas on volume and on number of media at every level
• A real-time dashboard with seventeen states, filterable by scope
• HTML reports by template and by provider, consolidated CSV exports
• Remote control of agents: around sixty commands
• Interface, emails and reports in five languages

What this changes for a service provider

Security and access

• AES-256 on the workstation, data key held by the client
• TLS 1.3 between agent and server, OpenSSL 3.5 v7
• A single listening port for agents, web and certificates
• Internal certificate authority, CSR and import of external certificates
• TOTP two-factor authentication, compatible with Google Authenticator v7
• Device enrolment: an unknown device triggers a code and an alert v7
• Let's Encrypt certificates issued and renewed automatically v7
• Client certificate enforceable per web user and for linked servers

The security model in detail

Day-to-day operation

• Watchdog: a separate service monitors the server and restarts it if it stops responding
• Server updates installed without interrupting backups in progress
• Automatic update of Windows agents, distributed by the server
• Periodic health check: disk space, log archiving, memory thresholds
• Logging per module and per process, configurable without restarting
• Every backup, restore or check runs in an isolated process
• A complete command line for scripting, with usable exit codes
• Backup-not-started alerts, computed from each medium's schedule