When something serious happens.
WHAT THE FIRST RULE IS
Stop, and establish the actual state before acting.
WHY
Most damage in incidents is done by the response.
WHAT TO ESTABLISH
What is broken What data is affected Whether it is still happening
WHAT TO DO ABOUT A WRONG UPDATE OR DELETE
Stop writes immediately.
WHY IMMEDIATELY
Every subsequent write complicates recovery.
WHAT TO DO NEXT
Establish exactly when it happened Confirm the backup and logs cover it
WHAT TO NEVER DO
Restore over the live database as the first action.
WHY
You lose everything that happened since.
WHAT TO DO INSTEAD
Restore elsewhere, extract what is needed, and apply it.
WHAT TO DO ABOUT A SERVER THAT WILL NOT START
Read the error log first.
WHAT THE COMMON CAUSES ARE
Disk full Corrupted files after an unclean shutdown Configuration change Permissions on data files
WHAT TO CHECK BEFORE ANY REPAIR ATTEMPT
That a copy of the current files exists.
WHAT TO COMMUNICATE
That there is a problem, and what is affected.
WHAT TO RECORD DURING
Every command you run.
WHY
It is what allows the incident to be understood afterwards.
WHAT TO PRODUCE AFTERWARDS
An account of the cause, and what prevents recurrence.
