Is your backup actually working? Here is how to find out.

Nearly every business I speak to has a backup of some kind. Very few have ever restored from one.

Those are completely different situations, and the gap between them only becomes visible on the day it matters most, which is also the day it is far too late to do anything about it.

The uncomfortable question

Not “do you have a backup?” but:

When did you last restore a file from it and confirm the contents were correct?

If the answer is never, then what you have is a process that reports success. Whether it produces a usable copy of your data is currently unknown.

That is not pedantry. Backups fail silently far more often than people expect, and the failure mode is always the same: everything looks fine until you need it.

How backups quietly fail

The drive filled up. The backup ran, could not complete, logged an error nobody reads, and has been failing for eight months.

The sync stopped after a password change. Somebody changed their Microsoft or Google password and never re-authenticated the backup tool. It simply stopped.

The folder that matters was never included. The backup covers Documents. The accounts package stores its data somewhere else entirely, and nobody checked.

It backs up to a drive left permanently connected. Which works for hardware failure, and is worthless against ransomware, because anything encrypting your computer encrypts the attached drive too.

The person who set it up left. Nobody knows the account, the password, or where it goes.

It is backing up a synced folder, not a backup. This is the most common misunderstanding, and it deserves its own section.

Sync is not backup

OneDrive, Dropbox and Google Drive are sync services. They keep the same files in two places.

That protects you against a dead laptop. It does not protect you against the thing that actually happens, which is a file being deleted, overwritten or encrypted, because the sync faithfully replicates that change everywhere within seconds.

Sync services do keep version history, and it can save you. But the retention is limited, it is not designed for bulk recovery, and it is not a substitute for a real backup with its own retention.

The half-hour test

Do this today. It is the highest-value half hour available to a small business.

1. Pick a real file. Something from the accounts system or a genuine working document, not a test file you created five minutes ago.
2. Note what is in it, so you can verify the contents rather than just the existence of a file.
3. Restore it from the backup to a different location. Do not overwrite the original.
4. Open it and check the contents are correct and current.
5. Note how long the whole thing took, because that number is your recovery time and you should know it.

Then repeat with something harder: a database, a mailbox, or the whole accounts folder.

If any of that could not be done, you have found a problem while it is still cheap to fix.

What good looks like

The standard worth aiming for is straightforward:

Three copies of your data. Two different types of storage. One kept off site.

For a small business that usually means: the live data, a local backup for quick recovery, and a cloud backup for the fire, flood or ransomware scenario.

Plus three things people forget:

Retention. If your only backup is last night’s, and the corruption happened three weeks ago, you have faithfully backed up broken data thirty times. Keep daily copies for a fortnight, weekly for a couple of months, and monthly beyond that.

Something offline or immutable. Ransomware specifically targets connected backups. A drive in a drawer, or cloud storage with immutability enabled, is what survives that.

A written recovery procedure. Who does what, in what order, with which credentials. Written down somewhere that is not on the server that just died.

The bits usually missed

• Email, if you use Microsoft 365 or Google Workspace. Neither is a backup service, and their retention for deleted items is shorter than most people assume.
• The accounts package, which often stores data outside the obvious folders.
• Cloud applications generally. Your CRM, your booking system, your payroll. Ask each vendor what happens if you delete something important, and whether they can restore it for you.
• Configuration. Not just data. How long would it take to rebuild the machine itself?

The question worth asking your provider

If you pay an IT company for managed backup, ask them one thing:

“When did you last perform a test restore, and can I see the result?”

A good provider will produce it. A provider who has never done one has been selling you a process, not an outcome.

If you would rather have somebody check

Testing a backup properly, finding what is not included, and setting up something that actually survives ransomware is usually a single session, and it is the thing I would push hardest for any business owner around Lake Macquarie.

It is not an ongoing contract and there is nothing to buy from me. Details are on the small business page.