The backup reports success every night. Restoring from it is a different test.
The report says completed, the light is green, and the monthly email says nothing failed. That tells you the job ran, and it’s the reason most offices feel covered.
A completed job says data was copied. It doesn’t say the copy opens, that it contains the thing you’ll need, that it’s out of reach of whoever encrypts the originals, or how many hours a full restore takes. CISA notes that many ransomware variants look for backups they can reach and delete or encrypt them, and NIST says backups need to be both maintained and tested.
Four things “completed” doesn’t show
- It opens. The file comes back and works, not just exists.
- It’s the right set. The accounting file, the job database, the phone system settings, the shared folders, and the mailboxes are on the list the backup covers.
- It’s out of reach. NIST says backups should have a copy stored offline, or otherwise out of reach of the attacker. CISA recommends offline, encrypted backups.
- It’s fast enough. Nobody has timed a full restore, so “back by Monday” is a guess.
A restore test for this week
- Pick the items yourself, before you tell the person who runs the backups. Choose three kinds: a spreadsheet you use, a folder with thousands of files, and one record from the program the business runs on.
- Make one of the three something from at least a month ago. Restoring last night’s file doesn’t show that older copies exist.
- Restore them to a different location. Never restore over the originals.
- Open each one. Check that the spreadsheet formulas calculate, the folder file count matches, and the record is complete.
- Write down who ran it, the date, the time the restore started, and the time it finished.
- Once a year, ask for a larger test: one whole computer restored to spare hardware or a virtual machine. CISA tells organizations to test backup procedures on a regular basis.
Where the copy sits at 2 a.m.
Ask the person who runs the backups these questions, and write down the answers: Where is the backup copy tonight, and which accounts can delete it? Which computer is it connected to all the time? Which copy is disconnected or locked against changes?
A backup that the office network can reach is the kind CISA says ransomware looks for. CISA lists delete protection and object lock for cloud storage as options, and says that if an outside company holds your backups, the same practices should be written into the contract.
Microsoft 365 deletions have their own clocks
These are recovery windows for deleted items. Whether your plan also includes a separate backup of Microsoft 365 is a question for whoever set it up.
Whoever administers your Microsoft 365 account may have changed these numbers, so ask.
- Mailbox. Microsoft’s default for deleted items in Exchange Online is 14 days, adjustable up to 30. After that the item is removed.
- Files in OneDrive and SharePoint. Deleted items stay in the recycle bins for 93 days in total. Files permanently removed from the recycle bin can’t be recovered.
- OneDrive Restore. It rolls a whole OneDrive back to an earlier time within the last 30 days, and Microsoft names ransomware as one use.
What a passing test covers
It covers the three items you picked, on the day you restored them. It doesn’t show that every folder is in the backup, that the copy is out of reach, or that a whole office could be rebuilt in a week.
If the test fails, you now have the date and what failed, before a bad day instead of during one. Take it to whoever runs the backups and ask for a written fix and a date for the retest. A failed test is the cheapest way to learn that the plan has a gap, and the person who runs the backups will want to hear it.
We run restore tests with you and tell you what restored and what didn’t, with dates.
A restore test turns “it completed” into a time and a date you can plan around.
Related
Sources
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.