Case note: catching a backup that had never been restored

Case note: catching a backup that had never been restored

A finance share that nobody can open is not a theoretical problem. It is a Thursday afternoon with payroll waiting. This note describes how we approach a restore when the backup job looked healthy and the restore path had never been rehearsed. No client is named.

First we ask what must come back, and in what order. Mail, the finance PC and the file server are rarely equal. Then we check whether the backup target is writable from every workstation. If ransomware can reach it as a mapped drive, the copy you trusted is already gone.

URBackup is what we put on most sites. If another product is healthy, we leave it. The audit tries a file restore and, where it is safe, a fuller recovery. You get that in writing before anyone talks about a new box.

The useful outcome is a restore someone has done calm, with a name next to the schedule. The 3-2-1 idea still applies: three copies, two kinds of storage, one somewhere else. Pretoria and Sandton are far enough apart to be useful copies of each other when the link and retention are planned.

If you want that looked at, read the backup page or book a backup audit.

Back to News