Question 1

We have backups but we do not know if they work

Accepted Answer

1. Open your backup software and check the last successful run. Timeline mostly green? Capture is fine.
2. Test-restore one file into a separate folder. Not over the original; if the backup is corrupt you do not want to lose the live file.
3. Write down how long it took to restore that one file. For a whole server multiply by 10-100x.
4. Run a full restore on a secondary system at least once a quarter. Four times a year beats never.

When to bring us in: 
No secondary system to restore to, or no test schedule? We run a restore drill in a temporary environment and give you a report. Two days of work on average.

Question 2

Suspected ransomware: what to do RIGHT NOW

Accepted Answer

1. Pull the network cable (Ethernet out, Wi-Fi off) on the suspect machine. Do not power off, do not reboot; there is temporary information in memory we may need.
2. Call us or another party you trust before running to the IT vendor demanding "fix it". Preserve evidence.
3. Check which shared folders the suspect machine had open. Temporarily disconnect those shares on the file server to stop spread.
4. Pay nothing, click nothing. Do not disable antivirus "to see what happens".
5. Write down what you see: time of first alert, which device, which user was on it. Critical for the investigation.

When to bring us in: 
Ransomware is not DIY; call us or a colleague who knows this terrain. Our role: containment, forensics, restore strategy, and any AP/customer communication.

Question 3

Someone accidentally deleted an important folder

Accepted Answer

1. Check the user's Recycle Bin (Windows) or Trash (Mac). 70% of reports end here.
2. On SharePoint/OneDrive: open the Recycle Bin via the web interface. Everything deleted within 30 days lives there.
3. On a file server: look in the backup system for the most recent version of the folder. Request a restore rather than improvising.
4. If it really was wiped from a local disk: stop writing to that disk (download nothing, save nothing) until you plan a recovery.

When to bring us in: 
For local drives with no backup, professional recovery is sometimes possible but expensive. Call before you fire up Recuva yourself; one wrong attempt can make recovery impossible.

Question 4

Our backup software has been failing for weeks and nobody noticed

Accepted Answer

1. Open the backup tool and look for the last "success" run. More than a week ago is a problem.
2. Read the error literally; it usually states what went wrong. "Disk full", "credentials invalid", "VSS snapshot failed": all fixable.
3. For "disk full": delete old backups beyond retention. Or tighten retention. Then start a new run immediately.
4. For "credentials invalid": refresh the service account password in the backup software. Often someone's AD password expired.
5. Set a weekly check email so this cannot drift unnoticed for three weeks again.

When to bring us in: 
Cannot read the logs, or the error is beyond the above? Drop us a line. Failing backups are more urgent than they look.

Question 5

Find an important email from two years ago

Accepted Answer

1. Outlook > search bar > "All Mailboxes". Start broad; deleted does not always mean gone.
2. Outlook > Deleted Items: up to 30 days everything stays there. Beyond: right-click "Deleted Items" > "Recover Deleted Items". Up to 14 more days recoverable.
3. Microsoft 365 with retention: ask IT to search in Compliance Center. With the right permissions, mail from years back is reachable.
4. Mailbox archive: in Outlook a separate folder at the bottom ("In-Place Archive" or "Online archive"). A lot of older mail may live there.
5. Very old: backup system. Ask IT whether an Exchange restore from a specific date is possible.

When to bring us in: 
Soft-delete recovery (last route) and backup restore are admin work; do not DIY, one wrong command wipes more. We do this regularly in about an hour.

Question 6

My laptop will not boot: did I lose my files?

Accepted Answer

1. Try power-on-power-off a few times. On Windows 10/11 three cycles trigger Recovery mode. "Startup repair" there often works.
2. Does OneDrive or another cloud sync run on this laptop? Most data is probably already online. Open OneDrive on another PC or phone.
3. No cloud backup and still no boot? Stop experimenting. Each extra boot attempt can worsen data loss if the disk is hardware-flaky.
4. Set the laptop aside. Do not open it, do not reset it. A specialist pulls the drive and reads it externally.

When to bring us in: 
For data recovery from a dead laptop: bring it in or ship it. We handle soft cases ourselves and have a fixed partner for hard disk damage. No guarantees but often doable.

Question 7

Word/Excel file accidentally overwritten: get the previous version back?

Accepted Answer

1. Open the file in Office online (browser) or via OneDrive web. Right-click the file > "Version history".
2. Click an earlier version to preview. "Restore" puts it back as the new current version; intermediate versions stay available.
3. Working via Outlook or Teams attachments: open the file online, not the downloaded copy, to access version history.
4. For files outside OneDrive on local disk: right-click > Properties > "Previous versions" tab only works if Windows File History is on.

When to bring us in: 
If version history is also gone, or the file was never in OneDrive, restore falls back to the backup system. For clients we do that in about an hour.

Question 8

How do I safeguard a large photo archive (business)?

Accepted Answer

1. Determine the volume. Under 100 GB fits on cloud storage (OneDrive Business, Google Workspace, Dropbox Business) without pain.
2. Above 100 GB: pick a NAS (Synology, QNAP) on-prem plus a second backup. Photos in one location are one-system-failure from gone.
3. 3-2-1 rule: 3 copies, 2 different media (NAS + cloud), 1 off-site (e.g. Backblaze B2 or S3).
4. Encrypt cloud uploads for photos with privacy concerns. Synology Hyper Backup includes built-in encryption.
5. Test once a quarter: pick a random old photo and restore it from backup. No test = no backup.

When to bring us in: 
For business photo archives (photographers, real-estate agents, marketing agencies) we set up the structure and schedule. One-time install, then automatic.

Question 9

What does the 3-2-1 backup rule actually mean for us?

Accepted Answer

1. Count your real copies. The live data is 1. A NAS in the same room is a 2nd copy but not a different media type if both are disk.
2. Identify your off-site copy. It must be physically elsewhere: cloud backup, an external drive kept at home, or replication to a second site.
3. Fill the gaps. No off-site? Add cloud backup (Backblaze, Wasabi, Azure). No second media type? Combine disk backup with object storage or tape for archive.
4. Check whether the off-site copy is immutable or air-gapped; otherwise ransomware encrypts that one too. The modern extension on 3-2-1, sometimes called 3-2-1-1-0.

When to bring us in: 
Not sure your setup qualifies? Send us a sketch of where things live; we spot the gaps in an hour and tell you what to fix. Before you build anything new, call first.

Question 10

What is an immutable or air-gapped backup and do I need it?

Accepted Answer

1. Realise: if an attacker gets domain admin, they can also reach your backup server. A regular backup share is then dead.
2. Object lock on cloud storage (S3, Backblaze B2, Wasabi) makes objects truly undeletable until retention expires. Not even you can remove them.
3. At the NAS level: Synology has WORM shares, Veeam has a hardened repository on a Linux box with immutable flags. These are separate projects to set up.
4. Air-gap = literally disconnected. An external drive you unplug daily is air-gapped. So is tape. Works, but requires discipline.

When to bring us in: 
Setting up immutable storage is not a quick job. Wrong retention and you are stuck with costs, too short and it does not protect. Call us before you activate object lock; that is literally non-reversible.

Question 11

Cloud backup or an on-prem NAS: which suits us?

Accepted Answer

1. Calculate how much data you have (TB) and how fast you need it back. Half a TB? Cloud is fine. 20 TB and your internet is 100 Mbit? A full restore from cloud takes days.
2. For fast restores: local NAS or backup server. Especially with file shares and VMs you do not want a queue.
3. For disaster (fire, theft, ransomware): cloud or off-site. Local-only is not a backup.
4. The common combo: local for speed, cloud as a second tier for disaster. Both with version history of weeks to months.

When to bring us in: 
We help you choose based on your data volume and recovery time targets. No vendor pitch; we run Synology, Veeam, and cloud-only setups for different clients.

Question 12

Microsoft 365 backs itself up, right?

Accepted Answer

1. Read Microsoft's shared responsibility model. Service uptime is theirs. Your mailbox content, OneDrive files, SharePoint sites: your responsibility.
2. Native retention (recycle bins, retention policies, version history) covers 30-93 days depending on setting. After that, it is gone permanently.
3. For restoring a bigger mistake, or after months, you need a third-party backup: Veeam for M365, Acronis, AvePoint, Datto, Keepit. All do point-in-time restore over years.
4. Test it. 'We have Veeam' is not the same as 'we can restore one user's mailbox from 18 months ago within an hour'.

When to bring us in: 
No external M365 backup? Start there. We roll it out per monthly license and immediately test a restore so you know it works. Half a day of work.

Question 13

How do we set up a proper restore drill?

Accepted Answer

1. Plan a drill day, block it on people's calendars. Not squeezed in; this is real work.
2. Pick a scope: once a year full restore (all systems), three times a year partial (one server or fileshare). Write down up front what 'success' means.
3. Restore on separate hardware or in an isolated VM environment. Never on top of production, not even 'carefully'.
4. Clock the time: hours until data is readable, hours until applications run. That is your real RTO, not the theoretical one.
5. Write a short report: what went well, what failed, what to change. That document is evidence for insurance and NIS2.

When to bring us in: 
First drill? Do not do it alone. We guide the first run and build a repeatable runbook so you do it yourself later. Two days of work on average.

Question 14

One user's mailbox is empty: can we restore just that one?

Accepted Answer

1. First: check Outlook > Deleted Items > 'Recover deleted items'. Up to ~30 days in 'Deleted items', plus a few days in 'Recoverable items > Purges' from Microsoft itself.
2. Then: M365 Compliance Center has eDiscovery/Content Search to recover a mailbox if the retention policy allows. Admin work.
3. With an external backup tool (Veeam, AvePoint, etc.): pick the user, pick a date, pick 'restore to original' or 'restore to PST'. The second option is safer if you are not sure what the user has changed.
4. Communicate with the user: have them close Outlook during the restore, otherwise you get sync conflicts.

When to bring us in: 
Restore-to-original can cause duplicates or conflicts if you choose wrong. Call before you tick 'overwrite'; undoing it costs more than picking right up front.

Question 15

I imported a PST archive and now I see duplicate mails or missing folders

Accepted Answer

1. Stop further imports. Each new attempt makes duplicates worse.
2. Make a copy of the original PST (the source) to a safe location. Do not work on top of the source.
3. Open the imported structure in Outlook and check where it went wrong; usually in the root under a separate folder with a date name.
4. For duplicates: use a tool like Outlook's own 'Mailbox Cleanup' or a specialised dedupe tool. Test on a copy first.

When to bring us in: 
PST work is admin work and data-critical. Call us before you run 'remove all duplicates'; there have been multiple cases where a dedupe script wiped the originals. We do this on a separate mailbox copy.

Question 16

Synology Hyper Backup target is full: now what?

Accepted Answer

1. Open Hyper Backup and look at the retention settings of that job. How many versions does it keep? Smart Recycle or fixed count?
2. Do not manually delete old .hbk files on the target; the index gets corrupt and you start over.
3. Lower retention via the UI ('number of versions to keep') and run the matching 'cleanup' task. Hyper Backup then trims safely.
4. For next time: set alerting at '80% full' on the target itself. Synology DSM can email that via the notification settings.

When to bring us in: 
Unsure about lowering retention? Talk first; too short and you lose the safety net for longer ransomware incidents. We calculate what is safe.

Question 17

How do I restore from Backblaze: and how long does it take?

Accepted Answer

1. Log into the Backblaze portal and navigate to the relevant bucket or computer backup.
2. For small restores (a few GB): pick files, hit download. Runs over normal internet, takes minutes to hours.
3. For large restores: choose 'restore by mail' (Personal) or batch large downloads (B2). For TBs, a shipped physical drive is cheaper and faster.
4. Plan ahead: what is your acceptable RTO? Cloud restore over a 100 Mbit line: at most 1 TB per day in practice. 5 TB? Count on a week.

When to bring us in: 
For disaster restore you do not plan 'we will see'. We build a runbook with estimated times and physical-media order process up front. Only then do you know if your RTO is realistic.

Question 18

A whole fileshare is suddenly empty or gone

Accepted Answer

1. Disconnect the share from users right away. On the file server: stop the SMB share. Prevents colleagues from overwriting data.
2. Check the file server event logs for mass deletes or encryption patterns. A row of .encrypted or .lock files smells like ransomware; then a different playbook (see suspected-ransomware).
3. Check whether Volume Shadow Copies are on for the server (vssadmin list shadows). Sometimes the most recent snapshot from hours ago saves you.
4. No shadows or corrupt: backup restore. Not on top of the live share, but to a staging location so you can compare before swapping.

When to bring us in: 
A vanished fileshare could be ransomware, but also hardware failure or human error. Call us before you restore; we first assess what happened, otherwise you restore over an attacker who is still inside.

Question 19

I am missing one specific mail, not the whole inbox: is that possible?

Accepted Answer

1. Write down what you remember: sender, subject fragment, rough date, attachment yes/no. The more, the better.
2. Outlook > search across all folders with that sender. Limit by date range. Include Deleted Items.
3. Nothing found? Ask IT to search M365 Content Search by sender and date. That also covers soft-deleted and in-place hold.
4. Truly nothing in M365 itself? External backup tool: find the item, restore just that one mail to a PST or back to your inbox.

When to bring us in: 
If the mail is critical (legal, financial) and there is an active matter: call directly. We search more often and faster. And we document the steps, in case evidence is needed.

Question 20

What is the difference between M365 retention policy and legal hold?

Accepted Answer

1. Retention policy: set for general compliance (e.g. keep invoicing mail for 7 years). Works on groups of mailboxes, with an expiry.
2. Litigation hold (or in-place hold): set when there is a legal matter. Freezes that one mailbox; everything is kept, even if the user tries to delete.
3. Neither replaces a backup. Microsoft says so themselves: hold protects against tampering, not against tenant failure or ransomware on the account.
4. Before lifting a hold, confirm the matter is truly closed and your legal team agrees. That is not an IT-only decision.

When to bring us in: 
Setting up or removing a hold sounds simple but has legal consequences. We only do this after written instruction from your legal contact. Do not call to 'just put everything on hold' without context.

Question 21

Fire, flooding or burglary: how does our data survive that?

Accepted Answer

1. Inventory: where is everything physically? Production servers, backup server, company laptops. Often all in one building.
2. Off-site must truly be off-site. An external drive in a drawer next to the server does not count. Cloud backup, replication to a data center, or a disk kept at home.
3. Test the scenario on paper: 'the building is gone tomorrow'. What data do you still have? Can you run the business with it? How long until you are operational?
4. Document a fallback location or cloud option for your team. People do not work without a laptop and internet. Having a 'work-from-home' emergency plan ready helps a lot.

When to bring us in: 
We build disaster-recovery plans for SMBs. Including a written runbook, tested cloud restore, and a list of fallback hardware. A day or two of work, refreshed yearly.

Question 22

Our backups are encrypted: where are the keys?

Accepted Answer

1. Inventory: which encryption is enabled at which layer? VM backup, fileshare backup, cloud backup: all configured separately.
2. Document where the keys live. Not in the same tool as the backup itself; that is like leaving the house key under the mat.
3. Keep at least two copies of the master key: one in a password manager managed by two people, one offline (paper in a safe).
4. Test recovery with the key annually. A forgotten key is something you want to discover in a drill, not a real disaster.

When to bring us in: 
Key management is not an IT detail, it is an existential risk. We help set up a key vault with a four-eyes principle and escrow procedures. Call before you trust a yellow sticky note.

Question 23

A test shows our backup is corrupt: no panic moves

Accepted Answer

1. Do not stop new backup runs, but do not let them write over the corrupt data. Retention often pushes older working copies out if you are not careful.
2. First try an older snapshot or version; often only the latest run is broken.
3. Read the logs and checksum warnings literally. Sometimes it is one file on the backup medium, sometimes the catalog itself is broken.
4. Copy the corrupt backup to a separate location before trying to repair anything. Tooling like 'verify' or 'rebuild catalog' can in rare cases break more.

When to bring us in: 
Backup corruption is one of those moments to call before you click. We have tools and procedures to extract data from half-broken backups. One wrong 'rebuild' and you start from zero.

Question 24

All recent backups are gone or broken: only a year-old copy left

Accepted Answer

1. Freeze that year-old copy. Make a second copy of it immediately on another medium. A lost last copy is what you really do not want.
2. Restore on separate hardware. Not on top of production. First see what you have, then decide what to do with live data.
3. Inventory what changed since last year: new clients, new contracts, new staff. Which of those is not in this backup?
4. Reconstruction of the gap: mailboxes, OneDrive, external systems (accounting cloud, CRM cloud). Often plenty is still there and you can piece together a workable whole.

When to bring us in: 
This is always a call moment, not DIY. We have done this trip before. A mix of data archaeology, customer/staff comms, and rebuild. Count on a week of work minimum.

Question 25

How do I know a backup run failed without logging in daily?

Accepted Answer

1. Turn off success mails if you do not have time to read them. Only enable failure mails. Otherwise it all goes to 'deleted' and you miss the failures too.
2. More important than failure mails: a 'no run since X days' alert. Otherwise you do not learn your backup server itself is off.
3. Send alerts to at least two mailboxes, not one person. Holidays and illness must not mean three weeks of backup silence.
4. For advanced: hook into a monitoring platform (Slack, Teams, PagerDuty, your own ticketing). With heartbeat checks confirming runs actually happen.

When to bring us in: 
We roll out monitoring for backup platforms, with alerts going to our NOC for clients on a service contract. No alerts sounds like no work, but it means the system is not working either.

Question 26

My backup job suddenly takes twice as long or much shorter than last week

Accepted Answer

1. Compare the delta percentage or change rate to previous weeks. Backup tools usually show how much data changed.
2. Sudden spike (e.g. 30% data changed on a quiet share): possibly ransomware encryption. Stop further backups so you do not overwrite good versions. Go to the ransomware runbook.
3. Sudden drop: maybe a share or disk is no longer mounted. Check the source; is everything that should run actually running?
4. Set a threshold above and below which you get an alert. Veeam, Acronis, Synology all have options for this.

When to bring us in: 
Unexpected change rates are a red flag. Call us before you trigger 'next run'; we can check together whether it is a valid business change or an attack symptom.

Question 27

Veeam, Acronis, Synology, Datto: which fits us?

Accepted Answer

1. VM environment (VMware/Hyper-V) on physical servers with an IT team: Veeam is the de-facto standard. Many features, needs expertise to set up well.
2. Mix of laptops, small servers and a wish for cybersecurity integration: Acronis Cyber Protect. All-in-one, easier self-management.
3. Small SMB with Synology NAS already running: Active Backup for Business (free with DSM) is surprisingly mature for PCs, M365 and VMs. Good starting point.
4. Fully MSP-managed needed: Datto, N-able, or similar. Higher cost but includes monitoring and restore support.
5. For M365 data specifically: a separate tool. Veeam for M365, Acronis, AvePoint, Keepit. Here you pick per use case.

When to bring us in: 
Wrong choice here costs you years. We do vendor-neutral advice based on data volumes, RTO and team capacity. No vendor kickbacks; you get honest counsel.

Question 28

File-level backup or full system image: what is the difference?

Accepted Answer

1. File-level: quickly restore smaller files. Good for fileshares, documents, user data. Not handy for 'my server must run as it was'.
2. Image: full OS restore in one shot. Good for servers and bare-metal recovery. Slower for restoring a single file; you mount the image first.
3. Many modern tools do both at once: image as base with a file-level browser inside. Veeam, Acronis, Synology Active Backup: all three can do this.
4. For SMBs: image backup of servers, file-level for laptops alongside OneDrive (since most data lives in cloud anyway).

When to bring us in: 
Which type for which system depends on RTO and complexity. We often design hybrids: image for servers, file for user data, external backup for M365. First setup takes a day or two.

Question 29

What are RPO and RTO and how do I set them for our business?

Accepted Answer

1. Ask per system: 'if this is down for two days, what does it cost us?'. For your admin maybe acceptable, for production or webshop not.
2. RPO determines how often you back up. OK to lose a day's work? Daily backup is fine. Max one hour? Frequent snapshots or replication required.
3. RTO determines where the backup lives and how you deploy. 24h RTO is fine from cloud restore. 4h RTO needs warm spare or hot replication.
4. Write it per system in a table. This document is a negotiation point with management and input for your investment. Make it concrete.

When to bring us in: 
An RPO/RTO exercise is not just technical; management must join for the business side. We facilitate a two-hour session in which we fill the table together. Afterwards you have a foundation for all backup choices.

Question 30

Backup runs during work hours and files lock up

Accepted Answer

1. Check scheduler for start time and duration
2. Shift to 22:00 or a quiet window
3. Enable incrementals so daily runs stay short
4. Verify VSS snapshots handle open files

When to bring us in: 
If window does not fit within 24h or skipped files persist

Question 31

Backup storage costs more than the production data itself

Accepted Answer

1. List per dataset how often you actually restore
2. Set retention 0-30d hot, 30-365d warm, 1y+ cold
3. On Backblaze or S3 Glacier cold saves 70-90%
4. Test one cold restore so the procedure is known

When to bring us in: 
If multiple TB and retention is unclear, request review

Question 32

How do we guarantee ransomware does not encrypt our backups too?

Accepted Answer

1. Move backup target to S3 with Object Lock or Wasabi immutable
2. Or use pull-based: backup server fetches, source has no write rights
3. Decouple admin credentials from the domain account
4. Test by trying to delete a test file on the backup target from production

When to bring us in: 
At any sign that the backup share is reachable via domain credentials

Question 33

We want a provable restore without panic

Accepted Answer

1. Pick the top-1 disaster scenario (e.g. fileshare gone)
2. Write the restore in four steps on one A4
3. Run it monthly on a test folder
4. Date-stamp the doc on every successful test

When to bring us in: 
If the test takes over 30 min or fails

Question 34

On handover nobody knows how restore works

Accepted Answer

1. Document per job: source, target, retention, password location
2. Add restore steps with screenshots
3. Record where encryption keys live (vault or password manager)
4. Deliver at handover and review yearly

When to bring us in: 
When taking over an environment without a runbook

Question 35

We have never done a real disaster drill

Accepted Answer

1. Pick a quiet Saturday
2. Restore a full VM or fileshare to an empty target
3. Measure exact time from start to usable data
4. Compare with agreed RTO and log gaps

When to bring us in: 
If measured RTO is more than 2x agreed RTO

Question 36

One SQL table is empty, the rest of the database is fine

Accepted Answer

1. Restore the DB to a staging instance, not over production
2. Export the right table or rows
3. Import back into production inside a transaction
4. Verify row count and keys before commit

When to bring us in: 
On relational dependencies or unclear rowcount

Question 37

Restore asks whether to keep newer or older

Accepted Answer

1. Always pick 'restore to new location' unless truly needed
2. Then compare timestamps and size
3. Only then copy back to production
4. Keep a backup of current state before overwriting

When to bring us in: 
When unsure which version is correct

Question 38

We have Google Vault, is that a backup?

Accepted Answer

1. Understand Vault only provides retention and search
2. For real restore use third-party backup like Spanning, Afi or Synology Active Backup
3. Test if you can fully restore a deleted Drive folder
4. Document scope: Drive, Gmail, Calendar, Contacts

When to bring us in: 
On compliance demands or accounts older than 6 months without backup

Question 39

Recover a deleted OneDrive file from an ex-employee

Accepted Answer

1. Check the user recycle bin (first 30 days)
2. If gone: second-stage site recycle bin (remaining time up to day 93 total)
3. On expired account: site restore via admin portal within 93 days
4. After that only via third-party backup

When to bring us in: 
At 90+ days old without external backup

Question 40

A whole SharePoint site is gone or corrupt

Accepted Answer

1. Open SharePoint admin center
2. Go to Deleted sites and restore within 93 days
3. For item-level restore in an active site: site recycle bin
4. Document which libraries are critical for backup scope

When to bring us in: 
On sites with over 1000 documents or external sharing

Question 41

Files in a Teams channel are gone

Accepted Answer

1. In Teams open the channel, click Files then Open in SharePoint
2. Use the site recycle bin there
3. For deleted channels: Teams admin restore within 30 days
4. For chat files: sender's OneDrive

When to bring us in: 
On a deleted Team older than 30 days

Question 42

Someone deleted a full day of calendar items by accident

Accepted Answer

1. Check Deleted Items in Outlook
2. Then Recover Deleted Items from Server
3. For bulk: PowerShell Search-Mailbox or a third-party backup
4. Document which calendar items are critical (clients, deadlines)

When to bring us in: 
On shared calendars or resource mailboxes

Question 43

Mailbox items permanently deleted with Shift+Delete

Accepted Answer

1. Ask admin for Recover Deleted Items on the mailbox
2. Extend RetainDeletedItemsFor to 30 days on the tenant
3. For longer retention: Litigation Hold or third-party backup
4. Verify single-item recovery is enabled

When to bring us in: 
At 30+ days ago without backup or hold

Question 44

Expecting a Wasabi bill higher than estimated

Accepted Answer

1. Read current pricing page for caps
2. Retention under 90 days still costs 90
3. Check your restore pattern: few restores fit well
4. Compare monthly with B2 if restore volume is high

When to bring us in: 
On volume restores exceeding monthly storage

Question 45

We replicate to a second NAS, that is backup right?

Accepted Answer

1. Keep replication for fast failover
2. Add real backup with retention and versions
3. Test: delete a test file and see if it is gone on the replica
4. Split goals: replication for uptime, backup for restore

When to bring us in: 
If only replication exists and no history

Question 46

Veeam reports repository corruption or inconsistent metadata

Accepted Answer

1. Run Repository Rescan in Veeam console
2. Check underlying disk with SMART or vendor tool
3. On failed disk: new repository, active full to it
4. Keep old repository read-only until new runs are verified

When to bring us in: 
On multiple failed verifies within a week

Question 47

We have tapes but no idea which one is where

Accepted Answer

1. Label every tape with date and pool (daily/weekly/monthly)
2. Keep a paper or digital logbook
3. Rotate offsite weekly (vault or director's home)
4. Test one tape monthly for readability

When to bring us in: 
If tapes older than 5 years are still in rotation

Question 48

Backup USB lost or stolen, data readable

Accepted Answer

1. Enable BitLocker To Go on the USB disk
2. Store recovery key in a password manager, not on the disk
3. Test mount on a second PC
4. Document the disk is encrypted in the runbook

When to bring us in: 
On loss of the recovery key

Question 49

Ransomware detection, first 60 minutes

Accepted Answer

1. Pull network cables on affected machines, keep powered on
2. Isolate backup server: stop replication to offsite
3. Take forensic image before restore
4. Communicate to staff: do not touch, do not log in

When to bring us in: 
Immediately: call insurance and CERT/Police within 24h

Question 50

Encrypted files, want to try a decryptor

Accepted Answer

1. Upload one encrypted file to id-ransomware.malwarehunterteam.com
2. Check nomoreransom.org for a matching decryptor
3. Test on a copy, never the original
4. If no match: only restore from backup

When to bring us in: 
On unknown variants or modern RaaS families

Question 51

Admin accidentally deleted an OU with 200 users

Accepted Answer

1. Check if AD Recycle Bin is enabled (Get-ADOptionalFeature)
2. Filter Get-ADObject -IncludeDeletedObjects by time
3. Restore-ADObject in batches per OU
4. Verify group memberships and password sync

When to bring us in: 
If Recycle Bin is off or objects older than 180 days

Question 52

Exchange database does not mount, dirty shutdown state

Accepted Answer

1. Eseutil /mh on the DB to check state
2. Eseutil /r with the correct log prefix for soft recovery
3. Only on missing logs eseutil /p (hard repair, data loss)
4. Then isinteg or New-MailboxRepairRequest

When to bring us in: 
Before running /p: dump LSNs and escalate

Question 53

SQL database corrupt, restore refuses due to existing db

Accepted Answer

1. RESTORE VERIFYONLY on the bak file
2. RESTORE DATABASE x FROM DISK = ... WITH REPLACE, RECOVERY
3. Verify with DBCC CHECKDB after restore
4. Schedule a health job after every critical restore

When to bring us in: 
On multiple corrupt pages or suspect mode

Question 54

Disk asks for BitLocker recovery key, nobody knows it

Accepted Answer

1. Check account.microsoft.com/devices for consumer keys
2. For AD: msFVE-RecoveryInformation on the computer object
3. For Azure AD: device blade in Azure portal
4. Document the found key in a password manager

When to bring us in: 
When none of the sources match

Question 55

DROP TABLE on production, no WHERE clause pain

Accepted Answer

1. Identify DROP time via SQL log
2. Restore full + differential + log chain to one second before DROP
3. Restore to staging, copy table back
4. Then switch read-only for production DBAs except owner

When to bring us in: 
On missing log backups

Question 56

New Mac, everything from the old one via Time Machine

Accepted Answer

1. Connect the Time Machine disk to the new Mac
2. Open Migration Assistant and pick Time Machine as source
3. Select account and data, skip apps if old OS is too far behind
4. Verify login keychain and iCloud sync after boot

When to bring us in: 
On a Mac with different chip architecture (Intel to Apple Silicon can stall on apps)

Question 57

Windows reset done, files were not synced

Accepted Answer

1. Check if OneDrive Known Folder Move had Documents synced
2. On loss: file recovery tool only if no TRIM on SSD
3. For future: enable Known Folder Move and BitLocker recovery escrow
4. Document reset procedure with backup checklist

When to bring us in: 
On wiped SSD with TRIM, recovery is unlikely

Question 58

How long must invoices, contracts and mail be retained?

Accepted Answer

1. Split admin (fiscal 7y) from other docs
2. Real estate related: keep 10 years
3. HR files: 5 years after end of employment
4. Set retention per category in M365 or fileshare policy

When to bring us in: 
When in doubt: bring in lawyer or accountant

Question 59

Client demands deletion, but backup retains for 1 year

Accepted Answer

1. Delete client data from production immediately
2. Document in privacy log that backups expire on X date
3. Restore procedure: re-delete that client right after any restore
4. Communicate this policy in the privacy notice

When to bring us in: 
On a DPIA request or regulator complaint

Question 60

Lawyer asks for litigation hold on a mailbox

Accepted Answer

1. Open Microsoft Purview, apply In-Place or Litigation Hold
2. Pick indefinite or an end date
3. Document the matter and period
4. Verify with a test delete that items remain in RecoverableItems

When to bring us in: 
On large scope (100+ mailboxes) or multiple matters

Question 61

Quick e-discovery request from management or lawyer

Accepted Answer

1. Open Purview, eDiscovery (Standard) or (Premium)
2. Create a case and add custodians
3. Search with keywords and date range
4. Export results to PST or CSV for the lawyer

When to bring us in: 
On Premium features (review sets, predictive coding) or cross-tenant scope

Question 62

Backup failure mails arrive at an expired mailbox

Accepted Answer

1. Create a DL or shared mailbox 'backup-alerts@'
2. Configure it as Notify in every backup job
3. Forward to Slack or Teams via webhook
4. Test by letting a job fail (simulate offline target)

When to bring us in: 
On silent failures going unnoticed for over 1 week

Question 63

Management wants oversight of backup without logging in

Accepted Answer

1. Generate the report from Veeam, Acronis or a script
2. Per job show: last run, success%, data sizes
3. Add the restore test from that month (date + result)
4. Send first of the month as PDF to management

When to bring us in: 
On 3 consecutive months without a restore test

Question 64

Backup tool shows dedup ratio 8:1, is that good?

Accepted Answer

1. Read the ratio in the tool (Veeam, Acronis, Synology)
2. Compare with similar environments
3. On sudden drop: check if a large dataset was added
4. Plan capacity based on trend, not one reading

When to bring us in: 
Below 2:1 on a VM environment (dedup is not working)

Backups and recovery