How To Recover Deleted Records in ServiceNow

Although it's probably not something you want to think about, your organization is likely to suffer a data loss at some point. In a recent study, we found that three out of four respondents experienced a data loss or corruption incident in the last 12 months. More often than not, this is caused by simple human error, such as accidentally deleting records.

Since you are ultimately responsible for the data you keep in SaaS applications like ServiceNow, it’s important to understand your data recovery options when using the platform. ServiceNow provides customers with several options to restore lost data, which we outline in detail below.

Delete Recovery module

The Delete Recovery module,  part of the Rollback & Recovery tools, allows you to restore deleted records and related changes within seven days.

1. Access the Delete Recovery module (Rollback & Recovery > Delete Recovery).
2. Locate the record that represents the data you want to restore. 
3. To restore the records, click the “Rollback…” UI action. Type in “yes” to confirm your choice.
4. You will see a dialog box that shows the progress of the recovery action. Once it completes, click “Close.”

Deleted Records module

The Deleted Records module can be used to recover deleted records that are in audited tables.

1. Navigate to Deleted Records (System Definition > Deleted Records)
2. Locate the record you want to restore.
3. Click the “Undelete Record” button.

Note: Cascade-deleted records can only be restored for seven days after being deleted. After this time, records can still be restored, but references will only be restored if the host table audits deletions.

Script Execution History module

This module works on scripts executed using the Scripts - Background module. This history only includes seven days of script executions. To find this module, navigate to Rollback & Recovery > Script Execution History.

Restore entire instance from the last backup

A full instance restore can be completed by requesting it from ServiceNow support. There are limitations in how far back the restore can be conducted, the granularity of the restore, and the amount of time it will take to complete the full instance restore.

Despite ServiceNow’s Advanced High Availability (AHA) architecture, they do acknowledge that, in certain scenarios, it may be desirable to use more traditional data backup and recovery mechanisms.

According to ServiceNow, such circumstances could be, "where a customer deletes some data inadvertently, or where a customer’s data integration or automation is misconfigured or malfunctions, resulting in data being rendered unusable or inaccessible." In these scenarios, the high availability capability would not assist and restoring from backup is the only option for recovery.

In addition to these limitations, the native restore capabilities provided by ServiceNow present users with several other challenges:

• Retention periods: Within ServiceNow, you can retain monthly backups of your production instance for up to 28 days, and daily backups for 7 days, periods which you cannot extend.
• Storage: Instances usually have a 4TB size limit with additional storage purchasable in 1TB chunks. 
• Speed of Restore: To recover your data, you need to work with ServiceNow support, which could take up to several days, depending on the size of your environment and whether you need to restore data in a granular fashion
• Granularity: Restore processes are designed to replace an entire database. Recovering specific data only requires additional steps that will further delay the entire restore process.

For these reasons, ServiceNow recommends avoiding restoring a production instance from backup and only doing it as a last resort.

The other options to restore data are to use the Deleted Records, Delete Recovery modules or - when the unwanted changes are based on script execution - to use the Script Execution History module.

While the Delete Recovery module enables recovery of records with relationships, that’s only possible for seven days. The Deleted Records module does not have the seven day limit. Instead the limit for how far data can be rolled back depends on whether the needed information is still in the audit records. The Delete Records module is also limited in that it won’t restore record relationships.

While ServiceNow provides industry-leading workflow management solutions, they do not have the same expertise when it comes to data recovery. That’s where OwnBackup can help.

OwnBackup Recover for ServiceNow equips organizations to better address data resiliency and compliance concerns with capabilities such as the retention of daily backups for up to 10 years, proactive notification of unusual data loss or corruption, and the ability to restore data - from the entire instance down to individual records - in self-service fashion

Contact us today to learn more about how we can help.