Storage, I/O, and Backups

Learning outcomes:

  • Explain how the operating system communicates with devices, including drivers, interrupts, and caching
  • Compare storage technologies such as SSDs, hard drives, flash, tape, and cloud storage
  • Describe how RAID protects against a failed drive, and why RAID is not a backup
  • Design a backup plan using the 3-2-1 rule, full and incremental backups, and snapshots

Would you like to download my PowerPoint to follow along?

  • How the OS Talks to Devices (I/O)
    • I/O means input and output: anything going into or out of the computer, such as a keyboard, a screen, a drive, or the network
    • Device drivers translate between the operating system and each kind of device
    • A device controller is the chip on the device, or on the motherboard, that does the actual work
    • On Linux, devices show up as files in /dev, such as /dev/sda or /dev/nvme0n1
  • Waiting for Devices
    • Devices are much slower than the CPU, so how does the CPU know when they're done?
    • Polling: the CPU keeps checking. Like checking your mailbox every five minutes
    • Interrupts: the device signals the CPU when it's done. Like a doorbell
    • DMA (direct memory access): the device copies data straight into memory without the CPU handling every byte. Like a delivery service that puts the packages away for you
    • Interrupts and DMA free the CPU to do other work while it waits
  • Buffering and Caching
    • A buffer holds data while it waits to be sent or used, like a waiting room
    • A cache keeps copies of recently used data in fast memory, so the next read is quicker
    • Write caching: the operating system may say a file is saved before it's really on the drive
  • Connecting Storage
    • SATA: the older connection for hard drives and some SSDs (SATA-IO)
    • NVMe: fast SSDs that connect straight to the PCI Express bus (NVM Express)
    • USB: external drives, flash drives, and almost everything else. USB-C is the common plug today (USB Implementers Forum)
    • Thunderbolt: a very fast external connection, common on Macs and high-end laptops (Thunderbolt Technology Community)
    • Network: NAS boxes and cloud storage connect over the network instead of a cable
  • Permanent (non-volatile) Storage Devices
    • Solid-state drives (SSDs): the most common drive in new computers. No moving parts, so they're fast and quiet (IBM: What is a solid-state drive?)
    • Hard disk drives (HDDs): spinning disks with a moving arm. Slower, but cheaper per terabyte, so still common in servers, home NAS boxes, and backup drives
    • Flash memory: USB drives, SD cards, and microSD cards
    • Cloud storage: OneDrive, Google Drive, iCloud, and Dropbox store your files on someone else's drives over the Internet
    • Magnetic tape: still used by large companies and data centers for cheap long-term backup and archives (LTO tape)
    • Historical note: CDs, DVDs, and Blu-ray discs were once the main way to share software and back up files. Most laptops no longer have a disc drive. Still worth knowing because older archives, software, and some game consoles still use discs, and you may need to recover data from them
  • How Hard Drives and SSDs Work
    • Hard drive: spinning platters, with a read/write head on a moving arm
      • Seek time: how long it takes to move the arm to the right track
      • Rotational latency: how long it takes the disk to spin to the right spot
    • SSD: flash memory chips and a controller, with no moving parts
      • Much faster, quieter, and harder to break if dropped
  • SSDs and Free Space
    • TRIM: the operating system tells the SSD which blocks are free, so it can clean them up ahead of time
    • Defragmenting (moving file pieces back together) helps hard drives, but SSDs shouldn't be defragmented. Windows and Linux run TRIM on SSDs instead (ArchWiki: Solid state drive)
    • The SSD spreads writes evenly across its chips (wear leveling), because each flash cell can only be written so many times
  • Disk Scheduling
    • Historical note: hard drives used to be the slowest part of a computer, so the operating system reordered requests to cut down on arm movement
      • First come, first served (FCFS): simple, but the arm jumps all over the disk
      • Shortest seek time first (SSTF): go to the closest request next
      • SCAN, the elevator algorithm: sweep across the disk in one direction, then back, like an elevator stopping at floors
    • Still worth knowing because hard drives are still in servers and NAS boxes, and the elevator idea shows up all over computing
    • Today, Linux picks an I/O scheduler for each drive. Fast NVMe SSDs often use none, and hard drives often use mq-deadline or BFQ (Linux kernel documentation: Block layer)
  • Partition Tables: GPT and MBR
    • A partition table is the map of where each partition on a drive starts and ends (partitions are covered in the File Systems week)
    • GPT (GUID Partition Table): the modern standard, used with UEFI. It handles huge drives, and up to 128 partitions on Windows (Microsoft: Windows and GPT FAQ)
    • Historical note: MBR (Master Boot Record) was the standard on computers with BIOS. It's limited to drives of about 2 TB and 4 main partitions. Still worth knowing because older computers and some USB drives still use it
  • RAID
    • RAID (redundant array of independent disks) combines several drives so they act as one (Linux kernel documentation: RAID arrays)
    • RAID 0 (striping): splits data across drives. Fast, but if one drive dies, everything is lost
    • RAID 1 (mirroring): two drives with identical copies. Survives one dead drive
    • RAID 5: data plus parity spread over 3 or more drives. Survives one dead drive
    • RAID 6: like RAID 5 with double parity. Survives two dead drives
    • RAID 10: mirroring plus striping. Fast and safe, but half the space goes to copies
  • RAID in Practice
    • Parity: extra data, worked out with math, that can rebuild a dead drive's data
    • Hardware RAID: a controller card does the work
    • Software RAID: the operating system does the work. Linux uses mdadm (Linux manual page: mdadm), and ZFS and Btrfs have their own RAID
    • RAID is not a backup. It survives a dead drive, but not deletion, ransomware, fire, or theft
  • Network and Cloud Storage
  • Data Integrity Protection
    • Computer systems often store critical information, such as inventories, financial records, and personal information
    • Crashes, power outages, natural disasters, ransomware, and simple mistakes can destroy this information
    • The results can be catastrophic
    • Systems should be fault tolerant: plan for disasters, and provide ways to recover from them
  • Backup and Recovery
    • Backup: store extra copies of information
    • Recovery: restore data after a failure
    • Physical safeguards such as locks and fire alarms are the lowest level of data protection
    • Full backups copy everything
    • Incremental backups copy only what has changed since the last backup of any kind
    • Differential backups copy everything that has changed since the last full backup
  • Types of Backups
  • The 3-2-1 Backup Rule
    • Keep 3 copies of your data, on 2 different types of storage, with 1 copy somewhere else (offsite or in the cloud)
    • Keep at least one backup offline, because ransomware tries to find and encrypt backups too. Test that you can actually restore from your backups (CISA: #StopRansomware Guide)
    • Watch out:
      • RAID is not a backup. It protects you if one drive fails, but not if a file is deleted or encrypted by ransomware
      • Cloud sync is not a backup either. If you delete a file in a synced OneDrive or Google Drive folder, it's deleted everywhere (though most services keep deleted files for a limited time)
  • Disaster Recovery
    • Plan ahead: what happens if the building floods, or ransomware hits? (IBM: What is disaster recovery?)
    • Recovery point objective (RPO): how much data can you afford to lose? An hour? A day?
    • Recovery time objective (RTO): how long can you be down before it really hurts?
    • The answers decide how often you back up, and how fast you need to be able to restore (NIST SP 800-34, Contingency Planning Guide, which defines RPO and RTO)
    • Ransomware and backups come up again in Week 12, Security and Protection

Suggested Activities and Discussion Topics:

  • Activity: find out what kind of drive your computer has. On Windows, open Task Manager, choose Performance, and click your disk. On macOS, open System Information and choose Storage. On Linux, run lsblk -d -o NAME,ROTA,SIZE (ROTA 1 means a spinning hard drive, 0 means an SSD). How full is it?
  • Discussion: is syncing your files to OneDrive or Google Drive the same as having a backup? What would happen if you deleted a file by accident, or got ransomware?
  • Activity: make a 3-2-1 backup plan for your own schoolwork and photos, using free or low-cost options. Where is each copy, and which one is offline?
  • Discussion: a small business has a NAS with RAID 1 and says "we're covered, we have backups." Are they? What could still go wrong?
  • Discussion: for your schoolwork, what's your RPO (how much work could you lose) and RTO (how fast do you need it back)? Does your current setup meet those?

Would you like to see some more classes? Click here