How to test your backups with a restore drill
A green tick in your backup dashboard doesn't prove you can get your data back. Here is a simple way to find out before you need to.
Most small businesses can tell you they have backups. Far fewer can tell you when they last restored anything from one. A green tick in a backup dashboard only proves that a job finished. It doesn't prove the files are readable, complete, or quick enough to get back when your office has stopped working. A test restore drill answers those questions on a quiet afternoon, instead of in the middle of an emergency.
What a backup report doesn't tell you
Backup software reports on the copy it made, not on your ability to run the business from that copy. These are the problems we see most often once a real restore begins:
- Something important was never included. A new shared folder, a database, or a laptop that joined the company after the backup was set up.
- Nobody has the password. Encrypted backups are only useful if the encryption key is stored somewhere you can still reach when your main systems are down.
- The backup was reachable by the attacker. If a backup drive or share is always connected, ransomware can encrypt or delete it along with everything else.
- The restore takes far longer than anyone assumed. Pulling several terabytes back from the cloud over an office connection can take days.
- The files came back, but the system didn't. A database or accounting package may also need its application, licenses and settings before anyone can use it.
How to run a simple restore drill
You don't need to take anything offline, and you should never restore over live data. Restore to a spare machine, a virtual machine, or a separate test folder.
- List what the business can't run without. Keep it short: email, accounting, the shared drive, your line-of-business application. Decide which matters most.
- Agree two numbers for each item. How much recent work could you afford to lose, and how long could you be without it? IT people call these the recovery point and the recovery time.
- Pick one item and restore it. Choose a real file set or system, not a sample someone prepared in advance, and start a timer.
- Have the person who uses it check it. Ask them to open recent files and do a normal task. IT can confirm that files exist, but only the user can confirm they are right.
- Check how old the restored data is. If the newest file is three weeks old, the job has been failing or skipping something.
- Write down what happened. Record the time taken, who did what, where the passwords were and what went wrong.
What to test, and how often
A sensible routine for a small office is one quick file restore every month and one full system restore every quarter, rotating through your critical systems so each gets tested over the year. Run an extra test after any big change, such as a new server, a move to Microsoft 365, or a change of backup provider. It's also worth remembering that data in cloud services isn't automatically protected against deletion or account compromise, so include those services in the drill.
What a good result looks like
You pass when someone other than the usual IT person can follow your written steps, the restored data is recent and usable, and the time taken fits the numbers you agreed. If the test fails, that's still a good result: you found the gap while it was cheap to fix. Keeping at least one copy offline or immutable is the fix that matters most against ransomware, and our ransomware protection page explains how that fits with other defenses.
Want a second pair of eyes?
If nobody in your business has time to run this, our managed backup service includes planning and testing, and we can help you turn the results into a proper disaster recovery plan. Call (213) 986-4855 to talk it through.