Test Your Backup This Week: A 30-Minute Restore Drill

Ask a room of business owners whether they have backups and every hand goes up. Ask when someone last restored something from those backups and the room gets quiet.

That gap is where most data loss actually happens. Not because nobody bought a backup product, but because nobody ever checked that it worked. A restore drill closes the gap, and you can run a useful one in about half an hour this week.

Why a backup you have never tested is a guess

Backup software reports success. That report tells you a job finished, not that the data inside it is complete, current and retrievable by someone who is not the person who set it up.

Things fail quietly all the time. A new SharePoint site was created after the backup scope was defined, so it is not included. Retention was set to thirty days and the file you need was deleted in March. The backup runs, but restoring the full mailbox takes eleven hours and you assumed twenty minutes.

None of that shows up in a dashboard. It shows up in a restore drill, which is the only honest test of backup testing there is.

The 30-minute restore drill

Set a timer, write down the start time, and work through these four steps. Do it on an ordinary Tuesday, not during a crisis. Tell your team what you are doing beforehand, because someone seeing files reappear in an unexpected folder tends to assume the worst.

Step one: pick three things, blind

Choose without checking whether they are backed up first:

• One document from roughly three months ago, ideally one that has since been edited
• One mailbox, preferably someone who left the company
• One folder from a shared drive or SharePoint site

Choosing blind is the entire point. If you only test things you know are covered, you are testing your memory rather than your backups.

Step two: try to get into the backup system

Before restoring anything, see whether you can even reach the console. Do you have credentials, or does one person have them? Does it require multi-factor authentication tied to a device that person carries?

Plenty of drills end here, and that is a valuable result. A backup nobody but one individual can access is a single point of failure with a holiday schedule.

Step three: restore, and time it

Recover each item to a separate location so you do not overwrite live data. Note how long each one takes and how many steps it involved.

Pay attention to the questions the system asks you. If you cannot confidently answer “restore to which point in time”, you have found something worth fixing while it is still theoretical.

Step four: open the files and check

This step gets skipped and it is the one that matters. Open the document and confirm it is the right version, not an empty shell. Open the mailbox and check whether folders, attachments and calendar items came back. A restore that returns something unusable is a failure that looks like a success.

Reading your results

Write down the recovery time for each item and compare it with what the business would actually tolerate. Then work through the honest questions:

• Was everything covered, or did you find a gap?
• How far back does your retention really go?
• Could a second person have done this without help?
• Are your backups reachable from the same network and credentials as your live systems, which is exactly what ransomware exploits?
• If your whole environment were gone, how would you even start?

That last question is the difference between file recovery and business continuity. Restoring a document is easy. Restoring a company is a different exercise, and most organisations have never thought it through.

Keep the notes. A drill you cannot compare against the previous one tells you how things stand today but nothing about whether you are improving, and the trend is usually the more interesting number.

What a good result looks like

A single document back within minutes. A mailbox within a couple of hours. Two or more people able to do it. Retention long enough to cover a problem you notice late, because deleted data is often discovered months afterwards. At least one copy that cannot be reached or encrypted from your production network.

If your restore drill matched that, you are in better shape than most. If it did not, you now know something you were previously guessing about, which was the whole objective.

Let us run this properly, and keep running it

A restore drill once is useful. The value comes from doing it regularly, because environments change constantly and the gap between what you back up and what you actually run widens month by month.

That is what we take on at EvolvingDesk. We test restores on a schedule, document how long each type of recovery takes, keep an immutable copy out of reach of your production network, and tell you plainly when something no longer fits. You get a report you can hand to an insurer or an auditor without having to reconstruct anything.

You do not need to remember to test. You need to know it is being tested, and that when it matters, someone who has done it before picks up the phone.

Ran the drill and did not like the answer? Plan a call and we will start with whatever surprised you.

Read more

• The 3-2-1 backup rule explained
• What is a managed service provider
• What happens to your data when an employee leaves

Further reading: the CISA guidance on data backup options and the NCSC backup guidance.