How do I know if our backups actually work?

The short answer

A backup counts only after somebody has restored from it. Ask for a restore test while you watch: name a file from three weeks ago, have it brought back, and note how long it took. When nobody can do that in front of you, what you have are copies rather than backups.

A business owner and a consultant at a meeting table, reviewing a printed report together

The three questions

What is being backed up? Name the machines and the systems, not the folders. Most offices discover that the laptops, the accounting database and the one shared drive somebody set up in 2019 are outside whatever runs at night.

Where does the copy live, and can it be reached from your office network? A copy that your computers can open is a copy that ransomware can open. At least one backup has to sit somewhere your day-to-day network cannot write to.

When did somebody last restore from it, and how long did it take? That is the question that separates a backup from a hope. Ask for the date and the result in writing.

Where backups quietly fail

The drive sits on the shelf beside the server, so the fire, the flood or the theft takes both. The job stopped four months ago and the failure email goes to somebody who left. File sync is mistaken for backup, so a deletion syncs within seconds and an encrypted file syncs just as fast. A database is copied while it is open, and the copy is unusable. One computer is covered and eleven are not. And the most common one of all: everything runs perfectly and nobody has ever tried to bring a file back.

Every one of these looks fine on a status screen. That is what makes them expensive.

The rule of three, in plain words

Keep three copies of anything you cannot lose. Keep them on two different kinds of storage. Keep one of them away from the building and out of reach of your network. It is an old convention in this trade because it survives the three things that actually happen: hardware failure, a burst pipe, and an attacker who gets in with a stolen password.

What a proper restore test looks like

Pick a file at random, from a date you choose rather than one you are offered. Have it restored to a separate location, so nothing live is overwritten. Open it and check the contents. Write down the date, who did it and how long it took. Do that quarterly for files, and once a year for the big one: a whole system brought back onto different hardware.

Time the big one honestly. The number you get is how long your business would be closed.

The question behind the question

How long can your business run without its files, and how much work can you afford to redo? Those two answers set what your backups have to do. An office that can lose a morning needs something different from a clinic that cannot lose an hour, and the cost follows from that rather than from a product name.

What we would do

On a business we have just taken on, the backup work runs in this order.

  • List every system that holds something you cannot recreate, including the databases behind your line-of-business software.
  • Check what is currently covered against that list, and show you the gap in writing.
  • Run a restore in front of you, with a file you choose, and record the time it took.
  • Move at least one copy out of reach of your office network, so an attacker with a password cannot reach it.
  • Set the failure alerts to reach a person here as well as somebody at your end.
  • Repeat the restore test on a schedule and put the result in your quarterly review.

Backups sit inside the monthly fee on every plan, along with the testing. The published prices are on the pricing page.

Two more questions people ask next

All the answers

Ask us to test your backup.

Leave your name and your number. A person calls you back the same business day, usually within an hour, and can walk you through checking your own backup on that call, before you have hired anybody.

Ask us to call you back

Leave your name and number. A real person calls you back the same business day, usually within an hour.

We use your number to call you back about your request. Nothing else.

Call me back