Every firm I talk to has backups. That’s not the problem. The problem is that almost nobody tests them.

Backups run in the background. They send a green checkmark to a dashboard somewhere. Your IT provider sees the checkmark and moves on. Months go by. Maybe years. Then something actually goes wrong, a server fails, ransomware hits, someone deletes something critical, and everyone discovers whether those green checkmarks meant anything.

Sometimes they don’t.

What goes wrong with untested backups

A backup can report success and still be useless. The job completed, but the data inside is corrupted. The backup covers the server but missed a critical database. The retention policy expired the version you actually need. The restore process takes 36 hours and nobody knew that until it mattered.

I’ve seen firms discover during an actual emergency that their backups were saving file system snapshots but skipping the application data that sits inside those files. The backup of the folder was fine. The backup of the database that lives in the folder was empty.

None of this shows up in a status report. It only shows up when you try to restore.

What a tested backup actually looks like

Testing a backup means restoring it and verifying that what comes back is usable. Not checking a log. Not confirming the job ran. Actually spinning up the restored system and confirming it works.

There are automated ways to do this. Our BDR systems run a weekly verification job that restores the backup into an isolated environment, boots the system, confirms the services start correctly, and reports back. No human intervention needed for the routine check. If something fails the test, we know about it before anyone needs that backup for real.

The specifics vary by client. Some firms need their practice management system verified. Others care most about their document management or accounting data. The point is that someone is checking, on a schedule, that the data can actually come back.

The questions worth asking

“When was the last time our backup was actually restored, not just checked?” There’s a difference between a backup job completing and a backup being verified. If your IT provider can’t tell you the last time they ran a test restore, that’s your answer.

“How long would it take to get back up and running?” The backup exists, great. But can you recover in two hours? Eight hours? Two days? If your firm bills $300/hour across 20 attorneys and recovery takes a full business day, that’s $48,000 in lost productivity before you count the client impact.

“What exactly is covered?” Email is backed up. File shares are backed up. But what about your practice management database? Your document management system? Your accounting software? Backups that miss one critical application create a false sense of security.

“What happens if the backup itself is compromised?” Ransomware operators specifically target backup systems. If your backups live on the same network as everything else, they’re vulnerable to the same attack. Isolated or immutable backups exist for this reason.

“Is anyone actually watching the backup reports, or just checking for green?” A daily email that says “backup successful” is not monitoring. Monitoring means someone reviews what was backed up, how much data changed, whether retention policies are holding, and whether the test restores are passing.

Why this matters more than it used to

Ransomware changed the backup conversation. Five years ago, backup was about hardware failure and accidental deletion. Recoverable within a few hours, low stakes, mostly an annoyance.

Now backup is your last line of defense against an attacker who encrypted everything on purpose. The recovery time is the difference between paying a ransom and telling the attacker to pound sand. If you know your systems can be restored in four hours from verified, immutable backups, that’s a fundamentally different negotiating position than “we think we have backups but we’ve never actually tested them.”

The firms handling this well aren’t doing anything exotic. They’re testing restores on a schedule, keeping backups isolated from production, and actually verifying that what gets backed up can come back in a usable state.

Artech Solutions manages backup and disaster recovery for law firms and professional services firms across the Des Moines metro. If you’re not sure whether your backups have been tested recently, or how long recovery would actually take, that’s worth a conversation.