Can you restore your data from backup?

Practical guide · about 7 minutes

Almost every business we ask says the same thing: “yes, we have backups”. It is the second question that changes faces: “when did you last check that they restore?”. Often the answer is never. A backup that has never been tested is not protection, it is an assumption.

This article explains what to check, without technical jargon, so you know whether your business would survive a bad day.

Three questions that reveal the real situation

Before anyone talks about technology, three answers need to be clear. If one is missing, that is where the problem is.

1. What exactly is being backed up? Often the main server is covered, but not cloud email, not the database behind the invoicing software, not the files on staff computers. List your systems and mark which ones are covered.
2. Where is the copy kept? If the copy sits on the same server or in the same office, a fire, a theft or a ransomware attack takes both at once.
3. How long would it take to get back to work? A copy that takes three days to restore may be useless for a clinic, but perfectly acceptable for an archive.

The 3-2-1 rule, explained simply

It is the best-known standard and it is easy to remember: three copies of your data, on two different types of media, with one of them off-site.

• Three copies — the original plus two backups. If one is damaged, the other remains.
• Two media — for example the server disk and a NAS, or a NAS and the cloud. You are not relying on a single type of device.
• One off-site — in another location or in the cloud. This is the copy that saves you from fire, flood or theft.

Many now extend it to 3-2-1-1-0: one immutable or offline copy, and zero errors on verification. The immutable copy matters particularly against ransomware, because attackers today deliberately look for backups before they encrypt anything.

Two numbers to settle before buying anything

These are business decisions, not technical ones. You answer them, not your technicians.

• How much data can you afford to lose? If the backup runs once a night, you can lose a full day's work. If that is unacceptable, you need a higher frequency.
• How long can you be without the system? Two hours, a day, three days? The answer decides whether you simply need a copy, or a standby server ready to switch on.

Without these two numbers, any solution is either needlessly expensive or insufficient at exactly the wrong moment.

Testing: the part that always gets skipped

Monitoring tells you whether a backup ran. It does not tell you whether it restores. These are two different things, and only the second one matters.

What to test

• Restoring a single file — the quickest and most frequent test.
• Restoring a database and opening it from the program that uses it.
• Restoring a full server into a test environment, to measure how long it really takes.
• Restoring email, if you use Microsoft 365 or Google Workspace.

How often

A small test every month and a full test twice a year is a reasonable rhythm for most small businesses. What matters is not the perfect frequency, but that the test happens and the result is written down somewhere.

The four mistakes we see most often

• Backups on the same server. When the server fails, the copy fails with it.
• Nobody reads the alerts. Backups have been failing for months and the error emails go to an address nobody opens.
• Only one person knows the procedure. If they are on holiday the day of the incident, the business waits.
• New systems get forgotten. A server or an application is added and nobody includes it in the plan.

In conclusion

A backup is not measured by the fact that it exists, but by the time it takes you to get back to work. If you don't know that time today, that is the first question to settle — and it is settled with a test, not with a promise.