Restore from a backup and time it

short · 45 min · Objective 3.4

Task

Take a backup, destroy the original, restore it, and verify the restored data is correct and complete. Then record how long the restore actually took, which is the number nobody has and everybody assumes.

Steps

  1. Create the dataset: a directory with several hundred files of varying size, and record a manifest of names and hashes with ABSOLUTE paths, so it can be checked from any directory: find "$PWD/dataset" -type f -exec sha256sum {} + > /tmp/manifest-before.txt (run from the directory that holds dataset).
  2. Back it up with a real tool and encrypt it, noting the key you used and — importantly — storing that key somewhere OTHER than the directory being backed up.
  3. Record the backup start and finish times.
  4. Destroy the original directory.
  5. Restore to the SAME path the data came from, timing it from the moment you start to the moment the data is usable — not just the moment the extraction finishes.
  6. Verify completeness and correctness: regenerate the manifest the same way into /tmp/manifest-after.txt and diff it against /tmp/manifest-before.txt. Record both timings and the diff result in /tmp/restore.md.

Files the Verify reads

The Verify block reads these by name, so save them exactly here:

  • /tmp/manifest-before.txt and /tmp/manifest-after.txt -- sha256sum manifests in sha256sum's own output format, with absolute paths, made by the same command before the loss and after the restore. A manifest of relative paths only checks out from the directory it was made in, and a restore to a different path makes every file look missing.

Verify

sha256sum -c /tmp/manifest-before.txt 2>&1 | grep -c "FAILED\|No such file"
python3 - <<'PY'
name=lambda l: l.rstrip('\n')[66:]    # 64 hex, two separators, then the path -- spaces and all
before=set(name(l) for l in open('/tmp/manifest-before.txt') if l.strip())
after=set(name(l) for l in open('/tmp/manifest-after.txt') if l.strip())
print('files before:',len(before),'| after:',len(after))
missing=before-after; extra=after-before
assert not missing, '%d file(s) did not come back: %s' % (len(missing),list(missing)[:3])
print('restore complete: every file returned')
PY
grep -ciE "minutes|seconds|elapsed" /tmp/restore.md

The first must be 0 — nothing failed its hash and nothing is missing. The assertion names the files that did not return, which is the failure mode that matters: a restore that appears to succeed while silently omitting something. The timing grep confirms you recorded the elapsed figure, because that number is the only honest input to an RTO.

Notes

Note where the key was stored. A backup encrypted with a key that exists only inside the system being recovered is not recoverable, and it is one of the five ways the lesson lists for a restore to fail while the backup job reports success every night.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.