How to find out whether your company backups can actually be restored

Why a green backup status is not enough

A backup can be incomplete, corrupted, too old or encrypted with a key that nobody has any more. With a database, you can have the files and still be unable to bring it up reliably without a consistent export or the transaction logs. A backup stored under the same administrator account can disappear together with production in an attack.

So first decide what needs to be restored after an incident: a single accidentally deleted file, an entire server, a database, mailboxes, or the company’s operations in an alternative environment. Each scenario calls for a different test.

A practical restore test procedure

1. Choose a realistic scenario.For example, restoring accounting data as of the previous day, or starting a virtual server from the last usable copy.
2. Assign responsibilities.A technician performs the restore, the data owner confirms the data is correct, and management sets the acceptable recovery time and data loss.
3. Prepare a separate environment.The test must not overwrite production or accidentally send emails to customers. Restore in isolation or under a different name.
4. Go through the whole procedure.From getting access to the storage, through decryption, to starting the service and verifying it. Don’t take an undocumented shortcut.
5. Check the content, not just the files.Open documents, log in to the application, and check database records and links to other systems.
6. Record the result and close the gaps.The date, the copy used, how long each step took, errors, missing access and who is responsible for fixing them.

What the test should tell the company

How often to test recovery

How often depends on the impact of an outage and on how much changes. Test critical systems more often than an archive that hardly ever changes. Repeat the test after a change of backup technology, a migration, a major update, a change in encryption, or the departure of the person who held the keys.

For a small company it makes sense to have a regular schedule, at least for the most important data, and to carry out smaller restores of individual files along the way. Every so often, a broader scenario covering a whole system should follow. The result belongs in the company’s IT documentation, together with the date of the next test.

The separate backup and data recovery service page describes how copies are designed, how storage is kept separate and how regular checks work in more detail. You will find more practical topics in the IT guides.