Your Backup Says It Ran Last Night. Here Is How to Find Out If It Restores

A four-person title agency lost a workstation to a failed drive on a Tuesday morning, which should have been a two-hour inconvenience given that they had been paying for managed backup for nineteen months. The dashboard showed nineteen months of successful nightly jobs, each one a green row in a table nobody had opened since the install. The restore attempt produced a folder structure with correct names and dates, and inside it, files that opened to nothing. The backup agent had been capturing a synced cloud folder that stored placeholders locally rather than actual file contents. Every job had run. Nothing had been backed up.

What makes that case worth staying with is that no part of it was negligent in a way anyone would notice. The agent was installed correctly, the schedule was sensible, the retention policy was longer than most, and the monthly report went out on time to an inbox where it was filed unread. The failure lived entirely in the gap between a job completing and a file returning, which is a gap that no status page is built to show you. A backup that has never been restored is not a backup. It is a billing arrangement with a storage vendor.

What the green check mark is actually measuring

Backup software reports on its own execution: did the process start, did it reach the destination, did it exit without an error code. Those are real facts and they are worth knowing, but they describe the software's experience of the night rather than your data's. Placeholder files, locked databases, mailboxes that require a separate connector, external drives that were unplugged and so were quietly skipped as absent rather than flagged as missing, permissions that changed when someone left the company: all of these produce clean completions and empty recoveries. The only test that measures the thing you care about is pulling something back and opening it.

The distinction shows up in what a competent provider volunteers without being asked. A barely adequate job reports uptime and job success. A good one reports what was excluded and why, names the systems it cannot reach with the license you bought, and tells you which of your data lives somewhere the agent does not go. Cloud-native mail, accounting software hosted by the vendor, the shared drive that one department set up on a personal account, the point-of-sale terminal: each of those needs a separate answer, and the honest answer is sometimes that nothing currently covers it.

Who is paid for the light being green

Follow the invoice and the incentive resolves quickly. Managed service providers typically bill backup per seat or per gigabyte protected, which means revenue tracks the volume of data ingested and the number of endpoints with an agent installed. Restore testing consumes technician hours, occasionally triggers egress fees at the storage layer, and produces findings that require unbilled remediation work. Nothing in the standard contract rewards the discovery that the last nineteen months were hollow. That is not a claim of bad faith; it is a description of where the money sits, and where money sits is where attention drifts.

The same pressure appears from the other direction with cyber insurance. Carriers increasingly ask applicants to attest that backups exist, are kept offline or immutable, and are tested. The attestation is a checkbox on a form, and the person filling it in is usually not the person who would run the test. A signature that turns out to be inaccurate is a problem at claim time, when the carrier's forensic accountant reads the application alongside the incident report. The cheapest hour anyone in this chain can spend is the one that makes the checkbox true before it is checked.

The ordinary week, done properly

A well-run backup practice looks almost boring from the outside, and it fits into a working week without anyone rearranging their day. Monday morning, someone spends ten minutes on the weekend's job log, not looking for failures but reading the byte counts, because a set that suddenly shrinks by forty percent is a warning that a status column will never show. Midweek, one file gets restored from one machine, chosen at random, opened, and confirmed to contain what it should. That is the whole exercise. It takes less time than a standing meeting and it converts an assumption into an observation.

Once a month the test gets larger: an entire folder, a mailbox, or a database restored to a scratch location and actually queried, with the elapsed time written down. That number matters more than most people expect, because a restore that technically works but takes eleven hours over a residential upload link is a different business event than one that finishes before lunch. Once a quarter, the exercise should involve a system nobody has touched, and it should be run by someone other than the person who built the backup, since builders test what they built rather than what they forgot.

The National Institute of Standards and Technology is responsible for the federal cybersecurity framework that most of this vocabulary comes from, and its language draws the same line: recovery is a function you exercise, not a product you own. The practical translation for a small office is two written numbers. How much work are you willing to lose, measured in hours, and how long can you be down, measured in the same units. Those two figures determine everything downstream, including how often jobs run, where copies live, and whether a single nightly snapshot is sufficient or comical.

Writing the test into the arrangement

When you hire this out, the contract should name the restore test as a deliverable with a frequency, not as an incident response promise. Ask what a test costs, and if the answer is that it is included, ask for the last three test records with dates, the systems restored, and the elapsed times. A provider doing the work well produces those in a few minutes because they already exist. A provider who has never run one will offer to schedule the first, which is a perfectly good outcome and worth having in writing.

Two more terms earn their place. Immutability, meaning at least one copy that cannot be altered or deleted by any credential on your network, including your own administrator account, which is what stops ransomware from encrypting the backups along with everything else. And an exit clause covering data return: the format, the timeline, and the cost of getting your archive out if you change vendors. Both are cheap to negotiate at signing and expensive to request later, when the person on the other end of the call knows exactly how little leverage you have.

The title agency rebuilt from a departing employee's old laptop and printed records, which took nine days. They now restore one file every Wednesday, and the person who does it is the office manager rather than the IT vendor, because the point of the exercise is that someone inside the building has seen the data come back with their own eyes.