The method
- Select a few non-confidential test files and record what you expect from each. Identify the backup copy, its date and the destination. If you are uncertain about the destination or tool behavior, stop before any operation that might replace data.
- Recover the sample into the separate location and compare names, sizes and readable content with your references. Distinguish files merely found from files actually opened. A list of filenames does not alone describe usable content.
- Record each file as recovered, opened, incomplete or unchecked. Include difficulties and the next verification. If infection is suspected, do not run a restored program simply to see whether it works; ask an appropriate specialist to examine the situation.
Fictional worked example
In a fictional exercise, two images and one document are copied into a test folder. The images open, but the document requests a password the learner does not have. The record states two opened and one unchecked; it does not declare the entire backup restorable.
The record to keep
Keep the date, sample, tool, destination and outcome for every file. This record makes separate trials comparable and identifies what remains untested.
Your record, step by step
For your own situation, record the following information. Check a field when it is documented; missing information still needs verification. The boxes are a reminder within this page.
This checklist does not validate your project. No entries are sent or saved.
Completed fictional example: these values only explain the method. Adapt the rows to your circumstances and keep unknowns explicit.
| Element | Value or observation | Interpretation |
|---|---|---|
| Document | The restored copy opens | Read the expected content |
| Photo | Thumbnail visible, file will not open | Record a failed test, not a successful restoration |
| Untested folder | No test performed | Leave the result unknown |
What this method can establish
A local check validates neither all data nor complete system recovery or incident resilience. Do not delete originals or other copies solely because this trial succeeded.
Restoring a backup: which files should you retain?
The newest file is not always enough to restore your data. The backup type determines which components recovery needs.
- Identify the backup set
- Locate dependencies
- Open a restored copy
| Situation | What changes | Useful check |
|---|---|---|
| Full | Copies all selected data. | Check the scope and excluded folders. |
| Incremental | Changes since the previous backup. | Retain the starting full backup and required increments in order. |
| Differential | Changes since the latest full backup. | Retain the starting full backup and chosen differential. |
Test a non-sensitive file in a separate folder without overwriting the original. Record the recovered version and errors. Disconnect the medium after use: a connected copy can also be affected by an incident.
Documentation : Cybermalveillance.gouv.fr — Sauvegardes ↗ · · Read the reference record →
Supporting documentation
These references support the method. Each source shows its language and consultation date; an available directory record explains its purpose.
- Cybermalveillance.gouv.fr — Sauvegarde des données numériques FR ↗
Documentation consulted on · Resource record : Cybermalveillance.gouv.fr
An editorial method, a fictional example and references for further reading.