Your backup says success. Can you restore a file?

Most businesses only find out whether their backup works on the day they need it. By then it is too late to fix.

The daily report says “completed” or “success”, so it is easy to assume everything is fine. That report tells you a job ran. It does not tell you that the files you need are in it, or that you can get them back in a usable state.

The Christmas break makes this worth doing now. The office is empty for a week or more, and a backup that quietly stopped in mid-December may not be noticed until the first busy day in January. Half an hour before you close is time well spent.

Why “success” is not the same as safe

A backup job can report success and still leave you short. The usual reasons are ordinary ones:

• It is backing up the wrong things. A new shared folder, a new laptop or a new line-of-business database was added after the backup was set up, and nobody added it to the job.
• It does not go back far enough. If the backup only keeps a week of history and a file was damaged or deleted three weeks ago, there is nothing to restore.
• It sits too close to the problem. A backup drive that is always plugged into the network can be encrypted by ransomware along with everything else.
• Nobody knows how to restore. The person who set it up has left, or the password for the backup is in one person’s head.

The Australian Cyber Security Centre says it plainly in its regular backups guidance for small business (first published 16 December 2022): regularly test that your backups can restore your important data, software and settings.

Microsoft 365 is not a backup on its own

Many businesses assume that because their email and files are in Microsoft 365, Microsoft has a copy. It does have some safety nets, but they are time-limited undo buttons rather than backups:

• Deleted files in SharePoint and OneDrive are kept in the recycle bins for 93 days, then permanently deleted (Microsoft Learn, updated 22 September 2025).
• Permanently deleted emails are kept for 14 days by default, and the setting can be raised to a maximum of 30 days (Microsoft Learn, updated 30 May 2024).

If nobody notices a missing folder or mailbox until after those windows close, it is gone. The ACSC’s guidance also notes that these built-in features are not enough for many incidents, such as an attacker taking over an administrator account and turning retention off.

A 30-minute restore test

You do not need to restore everything to learn a lot. Do this with whoever looks after your IT:

1. Pick a real file. Choose a document from your shared drive that someone changed in the last week. Not a test file - something people actually use.
2. Restore it somewhere else. Restore it to a different folder, never over the original, so a mistake cannot overwrite today’s work.
3. Open it and check it. Does it open? Is it the version and date you expected?
4. Try one more of each type. If you back up email or laptops, restore one email and one file from a laptop the same way.
5. Write it down. Note the date, who did it, what was restored and how long it took. That note is what you show an insurer or an auditor who asks how you know your backups work.

If any step fails, you have found the problem in November instead of during an outage.

Five questions to answer before you close

The ACSC’s small business cyber security handbook suggests every business has a simple backup plan that says what is backed up, when, and where it is stored. Before the break, check you can answer these:

1. What is backed up: servers, shared files, email, laptops, and any line-of-business system?
2. How often does it run, and how far back can you restore?
3. Is at least one copy kept separate from your network, so ransomware cannot reach it?
4. Who watches for failed backups over the break, and who can run a restore if they are away?
5. When was the last restore that actually worked, and is it written down?

If you are working through the rest of your shutdown jobs, our Christmas shutdown IT checklist covers email auto-replies, phones and remote access.

Where to start

Run the restore test this week, before December fills up. If the answers to the five questions are not clear, or the test does not go to plan, that is the conversation to have before you close.

To see what managed IT would look like for your business, get an instant quote, or book a meeting and we will go through your backup plan with you.