How to Actually Test
That Your Backup Restores

An untested backup is a belief, not a fact

If you have never restored a file from your backup, what you have is a belief that recovery would work. That belief might be correct. It might also be wrong in a way nobody discovers until the day it matters, when the original file is already gone.

A backup that runs every night and shows a green checkmark is not the same thing as a backup that has been proven to work. The checkmark tells you a job completed. It does not tell you whether the file it produced actually opens, whether it is the version you think it is, or whether it would still exist if the computer sitting next to it were gone. A status light cannot answer any of those questions.

The fix does not require an IT department. It requires picking a real file, restoring it somewhere harmless, and looking at it. That single act is what separates a business that has a backup from a business that has a working backup. This page is the companion to our small-business backup checklist and our ransomware restore readiness guide.

The restore drill

This takes most people under thirty minutes the first time and gets faster after that. Do it on a schedule, not just once.

• Pick a real file from a real date. Not something you created this morning to make the test easy. Choose a document, spreadsheet, or accounting file from a few months back, one you would genuinely be upset to lose.
• Restore it somewhere harmless, never over the original. Send the restored copy to a new folder or a spare computer. Overwriting the original defeats the point of the test.
• Open it and confirm it is actually right. Does it open without an error? Is it the correct version, with the content, dates, and totals you expect?
• Time how long the whole thing took. From the moment you started looking for the file to the moment you had a usable copy open on screen. Write the number down.
• Check whether that copy would survive losing the original machine. If the computer that holds the "original" burned up, was stolen, or was hit with ransomware tonight, would the copy you just restored still exist somewhere else? If not, you tested a second copy sitting next to the first one, not a backup.
• Write down the date, and put the next test on the calendar. A restore test proves the backup worked on that day, for that file. It does not prove anything about next month. Repeat it quarterly at minimum, and after any change to your computers, accounts, or backup settings.

What a pass looks like, what a fail looks like

A pass on one file, on one day, is not a guarantee about every future restore. It is proof that this copy, of this file, worked when you needed it to work today. That is a modest claim, and it is the only honest one. Anyone who tells you a tested backup guarantees recovery is promising something a single test cannot prove.

How a restore quietly fails without anyone noticing

The scariest failures are not the ones where the backup obviously did not run. They are the ones where everything looks fine until you actually try to use it.

• The file restores, but it is an old version. The job ran on schedule, but retention settings, a sync conflict, or a missed folder meant the copy that came back is weeks or months behind the real file.
• The backup covers the Desktop but not the accounting data directory. Most default setups protect the obvious folders and quietly skip the specific location where QuickBooks or a line-of-business app actually stores its data.
• The only copy sits on a drive in the same building as the original. An external drive on the same desk can protect against a failed hard drive, but not fire, theft, or a ransomware attack that reaches everything connected to that machine. See our pages on why an external drive is not a backup and why cloud sync is not the same as backup.
• Nobody knows the account password anymore. The person who set up the service left or changed roles. A backup nobody can log into is not meaningfully different from no backup at all.

Two light examples: OneDrive and QuickBooks

These are meant to show the shape of a restore test, not to replace the vendor's own instructions. Follow the current documentation from Microsoft or Intuit for the exact steps on your setup.

Why CISA and the FTC both say to test

This is not an opinion unique to us. It is the plain guidance from the agencies that publish small-business backup and ransomware advice.

CISA's small-business and #StopRansomware guidance recommends the 3-2-1 approach: at least three copies of your data, on two different types of media, with one copy stored off-site, plus offline or otherwise disconnected copies so ransomware reaching one system cannot reach all of them. Just as importantly, CISA is explicit that backups need to be tested, not just scheduled. A copy that has never been restored is an unverified assumption, not a control. See CISA's own guidance at cisa.gov/stopransomware.

The FTC's small-business cybersecurity guidance points the same direction: back up your data regularly, keep backups separate from your everyday network, and know how you would use them to recover if you had to. See ftc.gov/business-guidance/small-businesses/cybersecurity. Neither agency claims that a tested backup guarantees a future recovery. Both say an untested backup is not something you can rely on, and testing is the only way to know where you actually stand.