research/backups-only-count-once-restored
Backups Only Count Once You Have Restored One: A Restore Drill You Can Run in an Afternoon
Original Research • November 5, 2026 • 11 minute read
Executive Summary
A backup is a copy of your data kept somewhere else, so that a mistake, a failure or an attack does not take the business with it. Most small businesses have one. Very few have ever tried to use one.
That gap matters because backups fail quietly. A job can run every night for two years and copy the wrong folder. A database can be left out. The password that opens the archive can live only on the laptop that just died. You find all of this out on the worst day, when time is the one thing you do not have.
A restore drill closes the gap. You pick what matters, restore it into a safe, separate place, check that you can actually use it, and write down how long it took and what went wrong. This article walks through a drill that takes about four hours and needs no technician.
A backup you have never restored is a hope, and the only way to turn it into a plan is to restore one on a quiet afternoon.
What counts as “restoring” a backup?
Restoring means more than finding the file. It means getting from a backup copy to a working thing that people can use. For a website, that is a page that loads with its images, its forms and its recent posts. For a booking tool, it is last month’s appointments in the right order. For a customer list, it is a spreadsheet you can open with every column filled in.
There are three levels of proof, and each one is worth more than the last.
| Level | What you did | What it proves |
|---|---|---|
| 1. The file exists | You saw a backup listed with a recent date | The job ran. Nothing about the contents. |
| 2. The file opens | You downloaded it and opened or unpacked it | The archive is not corrupt and you hold the key. |
| 3. The business works from it | You restored it somewhere safe and used it | The backup is complete and you know the steps. |
Most owners have level 1. The drill below gets you to level 3.
Why do backups fail without anyone noticing?
A backup system only tells you about the failures it was built to notice. Here are the ones we see described most often, each of which a restore drill would catch.
- It copies the files but not the database. A website’s pages and images are one thing. The content, orders and user accounts often live in a database, which a simple file copy skips.
- It copies only part of the site. An upload folder, a second domain or a custom area sits outside the folder the job was told to copy.
- The backup lives on the same machine. If the server fails, the backup fails with it. If a person with access deletes things, they may delete the copies too.
- Nobody holds the key. The archive is encrypted, or the backup tool needs a login, and the only person who knew the password has left.
- The restore needs a step no one wrote down. The backup is fine, but putting it back requires settings, a certificate or a plugin that is not in the backup.
- It silently stopped. The storage filled up, a card expired, or a setting changed during an update. The dashboard still shows the last good date, and the date gets older.
Notice that none of these is exotic. They are ordinary gaps, and a rehearsal is the cheapest way to find them.
What do you need before you start?
Block out one afternoon, about four hours, and keep your calendar clear. Then gather four things.
- A list of what the business cannot lose. Be specific: the website, the customer or client list, bookings, invoices and receipts, product photos, email, and any app or tool you pay for.
- A list of where each one lives. Name the host, the service or the folder. If you cannot say where something is stored, write “unknown”. That is your first finding.
- The people and logins involved. Note who can reach each backup and which accounts you need. If a login sits with a former developer or a vendor, mark it.
- A safe place to restore into. This might be a staging copy of the site, a spare folder on your computer, or a test database. It must be separate from production.
If you work with an outside developer or host, invite them to the drill. Asking “can you show me how you would restore this?” is a fair question, and the answer tells you a great deal.
How do you run the drill, step by step?
Use a stopwatch. The total time is one of the numbers you came to learn.
Step 1: Pick one thing to restore first
Start with the single item that would hurt most to lose. For many businesses that is the website, or the customer list. Do one item properly before trying all of them. You can repeat the drill for the next item in a later week.
Step 2: Find the newest backup, and note its age
Open the backup list. Write down the date and time of the newest copy. Then ask yourself whether that is as recent as you would be comfortable with. If your last backup is seven days old and you take orders every day, you have just learned that a failure today would cost you up to a week of orders.
Step 3: Download it and open it
Get the backup onto a computer you control. Note how long the download takes. Open or unpack it. If it asks for a password, find out where that password lives, and write down who else could find it.
Step 4: Restore it into the safe place
Follow the steps the host or tool provides, or the steps your developer gives you. Do not restore over the live site. If the instructions are unclear, or do not exist, write that down. Missing instructions are a real finding.
Step 5: Use it as a customer would
Open the restored copy and work through a short list of checks. The list below is a starting point.
- Does the home page load, and do the images appear?
- Can you open a page or post from a month ago?
- Does the contact or booking form load? (Do not submit it from a restored copy that might send real messages.)
- Can you log in with a user account?
- For a customer list or booking history: is the newest entry there, are all columns filled, and does the count look right?
- Are uploaded files, such as PDFs and product photos, present?
Step 6: Stop the clock and write it down
Record the total time from “start download” to “restored and checked”. That number is your real recovery time. Most owners find it is longer than they assumed. Record what was missing too, even small things.
Step 7: Fix the smallest cause and repeat
If something failed, fix the most basic cause first, often the backup scope or a missing password, and run the relevant part of the drill again. When it passes, write down the date.
What should your drill notes look like?
Keep them on one page. A copy-and-fill template works well, and the table below shows the shape. The values are an illustrative example for a hypothetical landscaping company, not a real client.
| Item | Where it lives | Newest backup | Restore tested | Time to usable | Problem found | Fixed on |
|---|---|---|---|---|---|---|
| Website pages and images | Host account, nightly | 1 day old | Yes, staging copy | 95 minutes | Uploads folder was not included | Nov 12 |
| Customer list | Spreadsheet in cloud storage | Version history, live | Yes, opened old version | 10 minutes | None | n/a |
| Estimates and invoices | Accounting tool | Provider holds copies | No | n/a | Unsure how to export | Open |
An “Open” row is a normal result. The aim is a list of known gaps, each with an owner and a date, instead of a feeling that everything is probably fine.
How do you score the result?
After the drill, give yourself an honest rating for each item. A simple scale is enough.
| Score | Meaning | What to do next |
|---|---|---|
| Green | Restored, checked, written steps exist, time is acceptable | Repeat in six months |
| Amber | Restored, but slow, partial or dependent on one person | Fix the weak spot and retest within a month |
| Red | Could not restore, or never tried | Treat as a priority this week |
Be strict about green. If the only person who knows the steps is unreachable on weekends, that item is amber.
Does a longer recovery time matter?
It matters more than most people expect, because it sets how long you operate without the thing. Two numbers help you think about it.
- How old is the newest copy? This is how much recent work you could lose. If backups run nightly, the answer is up to one day.
- How long does a restore take? This is how long you wait before you can work again. You measured it in step 6.
Decide whether those two numbers fit the business. A shop that takes orders all day may find a one-day gap too wide, and may want more frequent copies for the database. A brochure site that changes twice a year can live with a longer gap. The right numbers depend on what a lost day or a lost week costs you, and only you can say that.
How often should you repeat the drill?
Twice a year is a good floor. Add a drill after these events:
- You change hosts, platforms or payment tools.
- You rebuild or redesign the website.
- A person who held key logins leaves, or you hand administration to someone new.
- You add a new kind of data, such as a booking system or a membership area.
- A backup alert or a hosting error tells you something changed.
Put the dates on the calendar when you finish the first drill. A drill that is not scheduled tends not to happen.
Which backup habits make the drill easier?
A few habits make restores faster and less stressful. None of them requires a technician to start.
- Keep a copy somewhere else. A common guideline is several copies, on more than one kind of storage, with at least one away from the main location. The exact numbers matter less than the idea that no single failure, mistake or lost login can remove every copy.
- Keep one copy that you cannot easily change. Some storage services let you lock a copy for a period of time. If a mistake or an attacker deletes your live data, a locked copy survives.
- Write the restore steps down. A page with the host, the login location, the order of steps and the checks makes the next drill faster and lets a second person do it.
- Store the keys separately. If a backup is encrypted, the key should be in a password manager or another place that does not depend on the same laptop or the same person.
- Name an owner. Someone should be responsible for the question “did the last backup run, and when did we last restore one?”
What can you do if you don’t have a technician?
You can still run most of this drill. The steps that need technical help are usually the restore itself and the scope of what the backup includes. For those, send your host or developer three questions in writing:
- What exactly does the backup include, and what does it leave out?
- Where is it stored, and who can delete it?
- Can you show me a restore into a test copy, and tell me how long it takes?
Keep the answers with your drill notes. If the answers are vague, treat that as an amber or red result. A good provider will answer plainly and may be glad someone asked.
Where an audit or a care plan fits
If you run the drill and find you cannot answer half of the questions, that is common and fixable. Our Audit Sprint is a fixed-price review that maps where your data lives, who holds the logins and what would need to be restored first, and ends with a written plan. If you would like the checks done on a schedule, our Care Plans cover regular maintenance. You do not need either to use the drill in this article.
Conclusion
A backup earns trust the same way a fire exit does: by being used in a rehearsal before the emergency. The drill takes an afternoon, costs nothing but attention, and replaces a comfortable assumption with a measured number and a short list of fixes.
This week, do three things. Write down what the business cannot lose and where each item lives. Pick the most important one and restore it into a safe place with a stopwatch running. Then write down the time, the gaps and a date for the next drill.
Related reading
- What a Quarterly Maintenance Visit Actually Covers, and What It Catches
- A Runbook for a One-Person Operation: What to Write Down First
- Your Website Is a Business Asset
Frequently asked questions
What is a restore drill?
A restore drill is a rehearsal of getting your data back. You take a real backup, restore it into a separate, safe place, and check that the website, the customer list or the booking history works as it did before. The point is to learn what is missing and how long recovery takes while nothing is on fire.
How often should a small business test its backups?
Twice a year is a sensible floor for a small business, plus one drill after any large change such as a new host, a new payment setup, a site rebuild or a change of who administers the accounts. Anything that touches how data is stored or backed up can quietly break the backup, so it deserves its own test.
Can I trust the green checkmark in my hosting dashboard?
A green checkmark usually means the backup job ran and finished. It does not tell you the file is complete, that it contains the parts you care about, or that you know how to restore it. Treat the checkmark as a clue that a backup exists, and the drill as the proof that it works.
Where should I restore a backup to test it?
Restore it somewhere that cannot touch your live site or live data: a staging copy, a spare folder, a test database or a temporary subdomain. Never test by overwriting production. If you are not sure a restore is safe to run, that uncertainty is itself a finding for your drill notes.
What should I do if the restore drill fails?
Write down exactly what failed, fix the smallest cause first and run the drill again. Common causes are a backup that skips the database, files stored outside the folder being copied, a missing password or key, and a backup that nobody on your team knows how to open. A failed drill is a good result, because you found it on a quiet afternoon.