Backups and disaster recovery: prove the restore path

Last updated: 5 Oct 20266 min read

tutorial

A backup is a recoverable copy of data or configuration. Recovery point objective describes the maximum acceptable data loss measured in time; recovery time objective describes the target time to restore useful service. A scheduled backup alone proves neither objective. Restore testing must include keys, dependencies, application compatibility, and a way to validate the recovered data.

Operational decision

A dispute service targets a recovery point within 17 minutes and useful read access within 74 minutes. That implies backup or replication frequency, retention, and restore capacity appropriate to those numbers. Encrypt copies, restrict deletion privileges, and keep a copy isolated from the credentials that can destroy the primary. In a drill, restore into a separate environment, run data-integrity checks, and measure time from declared failure to a verified user operation. The checklist below is a runbook outline, not executable commands. Include the database schema version and image digest expected by each restore point; an old backup with only new code can be unusable. Test a partial restore and a lost encryption key scenario, not only the happy path.

Recovery drill: dispute-service
RPO target: 17 minutes
RTO target: 74 minutes
1. Select an isolated backup point and verify its checksum.
2. Restore data, keys, schema version, and application digest.
3. Run integrity queries and one user-facing read.
4. Record observed data gap and elapsed recovery time.

Cost and verification

Frequent backups and geographically separate copies cost storage and network transfer. A cheaper policy may miss the agreed recovery point, while a fast snapshot is useless if a restore takes too long. Measure both objectives in drills and report misses. Replication can copy corruption or deletion quickly; keep independent point-in-time copies. Rotation and key escrow are operational parts of recovery, because inaccessible encryption keys make intact backup files unusable.