Verify Your Backups Actually Restore

Verify Your Backups Actually Restore

A backup you've never restored is only a hope. Prove yours works before you ever need it.

When to use

When you're not sure your data is backed up, after setting up a new backup, before a big system change, or any time you think "could we actually get our files back if a laptop died or we got hit by ransomware?".

Steps

1. List what must survive a disaster: business files, email, accounting data, your customer list or database, and your website. 2. Aim for the 3-2-1 approach - 3 copies of important data, on 2 different types of media, with 1 copy kept offsite or offline. 3. Confirm backups are automatic and recent. Check the last successful backup date for each item, not just that a service is switched "on". 4. Do a real restore test: pick a single file and a whole folder and actually restore them to a separate location, not over the originals. 5. Open the restored files and check they're complete and current - the test only passes if the data is genuinely usable. 6. Make sure at least one backup is offline or "immutable" so ransomware can't reach and encrypt your backups along with everything else. 7. Note how long the restore took and who knows how to do it, so recovery doesn't depend on a single person. 8. Set a recurring reminder (for example, quarterly) to repeat the restore test - backups drift and break quietly.

When to call a professional

To design backups for your core line-of-business systems, or during an actual ransomware event - don't pay, and don't wipe machines - contact your IT provider or MSP and report the incident first.

ACSC reference: Essential Eight - Regular backups; also in the ACSC Small Business Cyber Security Guide (cyber.gov.au/smallbusiness).