Backups That Actually Restore: A Test for a Small Office

A backup you have never restored is a hope, not a backup. To count, a backup needs three things: a copy that is separate from the original and cannot be reached by whatever damages it, a record of exactly what it contains, and a restore that someone has actually tried, on a schedule. Most small offices have the first half, often by accident, and never test the second. This post shows how to check yours in an afternoon, with a test log you can reuse and the questions to settle before a bad day.

• A synced folder is not a backup. Cloud folders that sync keep your devices matching each other. Delete or encrypt a file on one device and the change travels to the others. You have the same mistake in more places.
• A copy on the same computer or the same network is weak. Backblaze's description of the 3-2-1 rule (published 23 May 2024) is the usual starting point: three copies of your data, on two different kinds of storage, with one copy off-site, ideally more than a few miles from the others, so that a flood or a fire does not take every copy.
• A copy that you can reach with the same login is weak. If one stolen password opens both your files and your backups, one attacker takes both. Microsoft's ransomware guidance (page updated 13 October 2024) lists, among the common gaps, backups that “might not be offline or immutable” and a full restore procedure that you “might not test”.

NIST's small business cybersecurity basics (page updated 22 May 2026) put the habit in one line: “Regularly back up your data. Establish measures to protect and test your backups.” The word to underline is test.

Make the list for your office, with names, and write next to each item where the copy lives.

1. Files on shared drives and on people's laptops, including the Desktop and Downloads folders where work quietly piles up.
2. Email and calendars, wherever they live.
3. Your accounting and invoicing data, including the exports your accountant asks for. Ask your accountant how long you must keep records, and keep the backups for at least that long.
4. Your website, including its database and uploads.
5. Customer lists and chats that live on a phone: contacts, WhatsApp Business conversations and any spreadsheet kept only on one person's device.
6. Settings you would hate to rebuild: the router configuration, the list of accounts and licences, the domain registrar login and the passwords vault.

If you are replacing Windows 10 computers, as covered in Windows 10 support ended, the move is the best moment for a restore test: restore a real folder onto the new machine before you wipe the old one.

Not in the way most people assume. Microsoft's shared-responsibility documentation (page updated 5 May 2026) says: “For all cloud deployment types, you own your data and identities.” Its responsibility table lists customer data as the customer's in every model, including software as a service, and it names Microsoft 365 as an example of that model. It also describes “insufficient backup and disaster recovery” as a common unmet responsibility: backups that “may be infrequent, untested, or stored on-site”.

What the suites do keep is a grace period for deletions. Google's Drive help says files you move to the Trash “are deleted forever after 30 days”. Microsoft's Exchange Online documentation says a user can recover a deleted item only if it has not been purged and “the deleted item retention period for that item hasn't expired”, and that items purged by a person cannot be recovered by that user, although an administrator can recover them while the retention period lasts. A grace period is not a backup. It is a window, and the window closes: find the number of days for your plan, and put it in your calendar as the deadline for noticing that something went missing.

Do this once now, then on a calendar. Keep a log with one line per test, in a place the next person will find. Each line records the date, what was restored, from which copy, who did it, how many minutes it took, whether it opened complete, and the problem found.

1. Pick something real. One file from last month, one email, one record from your accounting data.
2. Restore it to a different place, not over the original, so you can compare.
3. Time it, and note who did it. If only one person knows the steps, you have found your first risk.
4. Check that it opens and is complete. A file that restores to zero bytes, or a mailbox without its folders, is a failed test.
5. Try one larger restore each quarter: a whole shared folder or a whole mailbox. A single file restoring does not prove a whole mailbox will.
6. Write down what you learned, and fix the slowest or weakest step.

The log matters for the day you are in a hurry. It tells you how long a restore really takes, who has done one, and which copy to trust first.

• How much can you lose? If the backup runs nightly, you can lose up to a day of work. Decide whether that is acceptable for each system, not for the office as a whole: the accounting data may need a copy every day, the archive of old projects once a week.
• How long can you be without it? A restore that takes two days may be fine for last year's files and unacceptable for your order system. Your test log gives you the real number.
• Who restores, and who decides? A named person, a named alternate, and a phone number that works on a Friday afternoon. Plan for the days the usual person is away for any reason, from a holiday to reserve duty.
• Where are the instructions? One page, stored outside the system that failed: what is backed up, where, how to restore, and who to call.

Backups that actually restore, tested on a schedule, are part of our office IT service, which is priced as a fixed monthly fee per office and scoped on a free intro call. We start by mapping what you have and what nobody looks after. See IT and infrastructure, or book a free intro call.

• Cybersecurity Basics, NIST Small Business Cybersecurity Corner, page updated 22 May 2026, as captured by Common Crawl on 7 June 2026.
• Protect against ransomware, Microsoft Learn, page updated 13 October 2024, as captured by Common Crawl on 11 April 2026.
• The 3-2-1 Backup Strategy of Data Protection, Backblaze, published 23 May 2024, as captured by Common Crawl on 14 May 2026. A vendor blog, cited for the definition of the rule.
• Shared responsibility in the cloud, Microsoft Learn, page updated 5 May 2026, as captured by Common Crawl on 8 June 2026.
• Delete files in Google Drive, Google Drive Help, as captured by Common Crawl on 18 May 2026.
• Recover deleted messages in a user's mailbox in Exchange Online, Microsoft Learn, page updated 30 May 2024, as captured by Common Crawl on 19 April 2026.