How to Test Your Backups Before a Disaster Proves They Do Not Work

Why Untested Backups Are Not Backups

An untested backup is a hypothesis, not a guarantee. Backup jobs that complete successfully every night can still fail to restore due to corruption, incomplete chain of custody, expired encryption keys, software version mismatches, or infrastructure that no longer exists in the same configuration. The only way to know your backup works is to restore from it.

Research consistently shows that a significant percentage of businesses attempting data recovery after a ransomware attack or hardware failure discover their backups are incomplete or unrestorable. The discovery comes at the worst possible moment: when operations are down, customers are waiting, and leadership is demanding answers.

The Three Levels of Backup Testing

• Level 1 — File restoration test (monthly): restore a random sample of individual files and verify their integrity. Quick, low-risk, confirms your backup agent is working and data is accessible.
• Level 2 — System restoration test (quarterly): restore a complete server or workstation to an isolated environment. Verify the OS boots, applications launch, and data is intact.
• Level 3 — Full failover test (annually): simulate a complete site failure and restore your entire environment to backup infrastructure. Measure actual recovery time against your documented RTO targets.

What to Document After Each Test

• What was restored, from what backup, from what date
• How long the restoration actually took — your measured RTO
• Any errors, warnings, or gaps discovered
• Whether the restored system met functionality requirements
• Actions taken to remediate any failures found
• Signature of the person who performed and verified the test