Restore from a backup and time it

short · 45 min · Objective 3.4

Task

Take a backup, destroy the original, restore it, and verify the restored data is correct and complete. Then record how long the restore actually took, which is the number nobody has and everybody assumes.

Steps

  1. Create the dataset: a directory with several hundred files of varying size, and record a manifest of names and hashes to /tmp/manifest-before.txt.
  2. Back it up with a real tool and encrypt it, noting the key you used and — importantly — storing that key somewhere OTHER than the directory being backed up.
  3. Record the backup start and finish times.
  4. Destroy the original directory.
  5. Restore, timing it from the moment you start to the moment the data is usable — not just the moment the extraction finishes.
  6. Verify completeness and correctness: regenerate the manifest and diff it against /tmp/manifest-before.txt. Record both timings and the diff result in /tmp/restore.md.

Verify

sha256sum -c /tmp/manifest-before.txt 2>&1 | grep -c "FAILED\|No such file"
python3 - <<'PY'
before=set(l.split()[-1] for l in open('/tmp/manifest-before.txt') if l.strip())
after=set(l.split()[-1] for l in open('/tmp/manifest-after.txt') if l.strip())
print('files before:',len(before),'| after:',len(after))
missing=before-after; extra=after-before
assert not missing, '%d file(s) did not come back: %s' % (len(missing),list(missing)[:3])
print('restore complete: every file returned')
PY
grep -ciE "minutes|seconds|elapsed" /tmp/restore.md

The first must be 0 — nothing failed its hash and nothing is missing. The assertion names the files that did not return, which is the failure mode that matters: a restore that appears to succeed while silently omitting something. The timing grep confirms you recorded the elapsed figure, because that number is the only honest input to an RTO.

Notes

Note where the key was stored. A backup encrypted with a key that exists only inside the system being recovered is not recoverable, and it is one of the six ways the lesson lists for a restore to fail while the backup job reports success every night.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.