Practical guides

A business backup is only useful if you can restore it

A simple review for business owners: check what is protected, inspect real backup results and rehearse recovery without overwriting live data.

Published · Reviewed

Review your backup and recovery plan All guides

Start with the work your business must recover

Instead of asking only whether a backup ran last night, ask which part of the business it would bring back. Your invoicing application may depend on its database, a file server and working user access. List those dependencies and put the most important workflows first.

Agree two practical limits: how much recent work the business could afford to lose, and how long it could operate without the system. These are often called the recovery point objective and recovery time objective. Use them to plan the backup schedule and recovery arrangement; a retention period alone does not answer either question.

Sources: Microsoft: Design a ransomware-resilient backup architecture

Check the real backup coverage and latest results

Ask for a record that identifies the protected system and the completed job, rather than relying on a configured schedule or the name of a backup folder. Record the last successful time and what happened to failures.

  • Which files, databases, virtual machines and configuration are included?
  • Are any disks, folders or application data excluded?
  • Where are the copies, and can the right people access them if the original server is unavailable?
  • Who receives failed-job alerts and checks that a later job actually succeeds?
  • Are the necessary recovery instructions and encryption keys available through an appropriate controlled process?

Separate checking stored data from proving a restore

Proxmox Backup Server offers verification jobs to check the integrity of stored backup data. That is valuable evidence about the copy. It does not, by itself, demonstrate that staff can use the recovered business application. Treat an actual recovery exercise as a separate check.

Keep enough detail to distinguish a file-opening test from a complete application or server recovery. A result should say what was tested and what remains untested.

Sources: Proxmox Backup Server: Maintenance tasks — verification

Run a controlled recovery exercise

Agree the test and destination with the administrator first. Use a separate location or isolated test environment so a rehearsal does not overwrite current work or send real invoices and emails. Schedule the work around storage and system load.

  • Choose a dated restore point and a meaningful sample: a required document or a representative application workflow.
  • Restore to the agreed test destination, preserving production data.
  • Check that the recovered content opens, reflects the expected date and can be used by the authorised person.
  • Measure the time needed to reach the agreed usable state, including preparation and access.
  • Record failures, assign corrections and repeat the affected test after they are fixed.

Sources: Proxmox VE documentation: Backup and restore

Protect the recovery copies as well as the originals

Review who can change or delete backups and whether a problem in the main environment could also affect every recovery copy. Microsoft’s ransomware planning guidance recommends isolated copies and offline, off-site or immutable storage, alongside recovery exercises. The appropriate arrangement depends on the business and the backup product.

A permanently connected external drive is not an offline copy while it remains connected. No single storage arrangement should be described as ransomware-proof. Keep the recovery procedure available if normal email, accounts or servers cannot be used.

Sources: Microsoft: Backup and restore plan to protect against ransomware

Ask for a review with evidence

IT Works provides local and cloud backup, backup monitoring, restore support and disaster recovery planning in Mauritius. Start with the systems to protect, existing backup products, the latest completed-job results and your recovery priorities. If a loss or suspected attack has already happened, describe the symptoms before attempting restores over live data.

Frequently asked questions

Is a green backup status enough?

It shows the job reported success, but it does not prove every required application workflow can be recovered within your available time. Use a controlled restore exercise and document what it demonstrates.

Sources: Microsoft: Design a ransomware-resilient backup architecture

How often should we test recovery?

Agree a schedule around the importance of the system, its changes and the recovery risk. Repeat relevant tests after changes to applications, backup configuration, storage or recovery procedures. There is no single interval that fits every business.

How long should we retain backups?

Decide this from the business need, available storage, recovery risks and applicable records requirements. Do not copy an example retention period without checking whether it fits your organisation.

Sources and further reading

WhatsApp us