A restore check that ends when the backup tool reports success and the administrator who ran it opens the file proves only that the data came back. An administrator's account often has broader rights than the people who use the file, so it can open things they cannot. NIST's Cybersecurity Framework 2.0 lists "Backups of data are created, protected, maintained, and tested" as outcome PR.DS-11, and its recovery outcome RC.RP-05 covers verifying the integrity of restored assets and confirming normal operating status.

CISA's StopRansomware Guide advises regularly testing the availability and integrity of backups in a disaster recovery scenario. For this test, integrity means the right version came back, and availability means the person who needs the file can open it from their own account. The test also checks the reverse: that they get no more access than you meant to give. The fresh account is one that took no part in the restore, such as a designated tester's own everyday sign-in.

Why a good restore can still fail the user

A person can reach a file by several routes, and a restore can change any of them. In Google Drive, access can come from being added by email address or Google Group, from the file's General access setting, or from the folder it sits in, because files and subfolders inherit a folder's sharing permissions. Microsoft's sharing help for OneDrive and SharePoint lists direct access, sharing links and access to the site itself.

Restore methods treat those routes differently:

  • The Google Admin console returns restored Drive items to the same location, and the user must reshare them before others have access
  • A copy made from Google Docs version history gets the original's sharing only if you choose Share it with the same people, but it still inherits the folder you save it in
  • Microsoft 365 Backup's restore to the original location gives files the destination folder's permissions and does not restore item-level permissions
  • Replacing a whole OneDrive or site with a Microsoft 365 Backup copy reverts file and folder permissions to the restore point

A restored copy can also land where only the restorer can see it, or come from the wrong date and open without complaint. A check by the restorer alone can miss all of these.

Choose the file and who takes part

Pick an ordinary, non-sensitive file with a detail you can recognize, such as the total on a weekly supply order. Choose a detail that has changed since the version you will restore, so that anyone who opens the live file by mistake gives a different answer. Take the file from the storage your team depends on most; CISA's guide says knowing which data and systems are most critical helps set restoration priorities.

Choose a version date that is not today, and stay inside what your tool can restore one file at a time. Microsoft 365 Backup, Microsoft's pay-as-you-go backup service for OneDrive, SharePoint and Exchange, restores individual files and folders only from recovery points within the most recent 14 days, which are roughly daily; older points support only a full OneDrive account or SharePoint site restore. If no restore point exists for the date you pick, it asks you to confirm the nearest available one, so note the point it actually used.

The tester should hold no administrator rights and have no part in the restore. The restorer should be whoever would do the job in a real incident, working from your runbook, so the test checks the instructions too. Confirm that person has the rights the tool needs; Microsoft 365 Backup's file and folder restore, for instance, requires the SharePoint Backup Admin role.

Set up the test in a temporary folder

Create the temporary folder in your own My Drive or OneDrive rather than inside a folder or site that other people can already open. Google's sharing help says you cannot give someone less access to a file than they have to its parent folder, and Microsoft's says access can be inherited from a parent folder or from the site.

Then follow these steps:

  • Restore a dated copy, not today's version, into the temporary folder instead of over the original
  • Share that folder with the tester and no one else, with view access only
  • Have the tester sign in with their own account, on their own computer or in a private browser window
  • Ask them to open the file and read back the detail you chose and any date shown in it

In Google Drive, select the folder, click Share, enter the tester's email address, choose Viewer, check Notify people so they get an email alert, and send. In OneDrive, select the folder and select Share, use the settings gear to set the link to Specific people and select Apply, then add the tester in the Name, group or email field, choose Can view with the pencil icon and select Send.

Microsoft notes that a Specific people link does not rule out others who already have access, and that people with edit permission on a folder can copy, move, edit, rename, share and delete anything in it they have access to. View-only sharing and the access check below address both risks.

A browser that is still signed in as the restorer defeats the test. If the tester has to borrow a computer, use a private window; Chrome's help says that in Incognito mode it does not automatically sign you into your Google Account or other websites. Close every Incognito window first, because Chrome continues an open Incognito session in any new Incognito window, then press Ctrl+Shift+N on Windows or Command+Shift+N on a Mac.

Make the dated copy without touching the original

Use your backup tool's option to restore to a different location if it has one, because the backup is what you are testing. If it can only restore in place, ask its supplier how to test without overwriting live files. If you use Microsoft 365 Backup, select Settings and then Microsoft 365 Backup in the Microsoft 365 admin center, select Restore in the OneDrive or SharePoint section and choose Restore specific files or folders. On the Choose destination page, select Create a new folder and restore to it, not Restore to the original location.

That new folder, named Restored Items with the date and time in UTC, appears at the root of the document library the files came from, so it takes the place of your temporary folder. For a OneDrive file that means the owner's OneDrive, which makes the owner a natural tester; they already have full access, so the access check becomes a check that no one else has any. On a SharePoint site, people with access to the site may be able to open the folder, so check its access before you count the result.

The Google Admin console's Restore data option is not built for this. It recovers deleted items only, cannot restore individual files or folders, brings back everything removed during the dates you choose and, depending on the amount of data, can take several days to appear.

If Google's own tools are all you have, version history in Docs, Sheets and Slides can make a dated copy to practice the access check: open the file, click Last edit at the top right, select More next to the version you want, then Make a copy, and save it to the temporary folder with Share it with the same people left unchecked. Browsing versions requires edit permission on the file, and a copy made this way tests version history, not a backup.

Do not use Restore this version in Google's version history for the test. It makes the older version the live file, and on a spreadsheet Google says it clears the cell-by-cell edit history for changes made before the restore.

Do not use the Restore command in OneDrive or SharePoint version history either. Microsoft's help says the version you select becomes the current version in OneDrive, and SharePoint creates a copy of it as the latest version, so everyone opening the live file would get the older content. Skip Restore your OneDrive too: it undoes all actions on files and folders back to a point within the last 30 days, and files created after that point go to the OneDrive recycle bin.

Run the tester's check

Before the tester opens anything, have them check the account picture or initial at the top right of the page, where Google and Microsoft both place the controls for switching or signing out of accounts. Google's account help says that when you are signed in to several accounts it cannot always tell which one you are using, and that the default is often the first account you signed in with. A tester whose link opens under a personal account can be refused even though the restore and sharing worked.

Ask the tester to open the file from the sharing email, read back the detail you chose, and then try to type a change. Google says a Viewer cannot make changes, add comments or share the item, and with Can view in OneDrive the tester should be able to read the file but not edit it.

Check the access as well as the file

In OneDrive or SharePoint, select the temporary folder, select Details in the upper-right corner of the command bar, and then select Manage access. The tester should be the only person you added, and any link should be the one you sent to the tester. A link with the wrong permission has to be deleted and recreated, because Microsoft says you cannot change a sharing link from view to edit or from edit to view.

In Google Drive, open Share on the folder and confirm that General access reads Restricted and that the only person listed besides you is the tester, as a Viewer. Anything wider fails: Google says Editors can change permissions and share by default, and Anyone with the link lets anyone on the internet who has the link open the item without signing in.

Count the test as failed if the tester could not open the file, saw the wrong version or had more access than you granted. Fix the cause, then run the test again before you rely on that backup.

Record the result and clean up

Keep a short record of each test:

  • When the restore started and when the tester confirmed the file
  • The version date you asked for and the restore point the tool used
  • Where the copy landed and who owns it
  • Who ran the restore and who tested it
  • Whether it passed, and the cause of any failure
  • The next test date and the system it will cover

Store the record beside your recovery runbook. The time between the restore starting and the tester confirming is a realistic measure of how long one lost file takes to get back to the person who needs it. If you back up more than one system, such as Google Drive and OneDrive, test a file from each, because the restore and sharing steps differ.

Then remove the tester's access. In OneDrive or SharePoint, select Stop sharing under Manage access; in Google Drive, open Share, select the Down arrow next to the tester's name, choose Remove access and click Save. Confirm the access is gone, then delete the temporary copy, including any Restored Items folder the backup tool created. In OneDrive on the web, select Shared in the left pane and then the By me tab to find anything still shared.

With a Google work or school account you can also make the tester's access end on its own: in the Share menu, select the Down arrow next to their name, choose Add expiration, pick a date within one year and click Save. For folders this is available only for the Viewer role, which the tester should have anyway.

Common mistakes and how to spot them

Testing in the restorer's browser. The account picture at the top right shows the wrong person, or the tester never had to sign in. Close every private window and start again in a fresh one.

Reading the live file instead of the copy. The detail the tester reads back matches today's version, perhaps because they opened the original from their recent files. A detail that has changed since the version date is what exposes this.

Restoring into a shared place. The Share dialog or Manage access lists people you did not add, or access inherited from a parent folder or site. Move the copy to a folder you own, where you control its sharing, and check again.

Overwriting the original. Colleagues see older content, or the live file's version history shows a new current version from the time of the test. In OneDrive, Microsoft says the version that was current becomes the previous version in the list, so restore that one straight away, then repeat the test with a copy.

Rolling back a whole account for a one-file test. If Microsoft 365 Backup's Choose destination page offers Replace accounts with backups or Replace sites with backups, you are in a full restore, not a file restore. Microsoft notes that accounts and sites being restored to a prior point in time are not locked read-only, so people can lose edits they are making.

A worked example

Imagine a ten-person accounting office on Google Workspace. The office manager picks the supply order sheet from the office's shared drive, because its total changes every week, and notes the total as it stood two Fridays ago. She uses the office's backup tool to restore that version into a new folder named Restore test in her own My Drive, then shares the folder only with the receptionist as a Viewer, with access set to expire the next day.

The receptionist opens the emailed link on her own laptop and is refused. The manager checks the Share dialog: General access reads Restricted and the receptionist's work address is listed as a Viewer, so the sharing is right. The initial at the top right of the receptionist's screen belongs to her personal Gmail account, which she had signed in to first, so the manager records a failed attempt caused by the setup, not by the backup.

The receptionist closes every browser window, opens an Incognito window, signs in with her work account only and opens the link again. She reads back the date on the sheet and that Friday's total, which differs from today's, and finds she cannot type in it. The manager completes the record with the time from the start of the restore to this confirmation.

She then removes the receptionist's access, confirms it is gone and deletes the copy. She books the next test for a different file, to be restored by the bookkeeper, who would run restores if the manager were away.

What to do this week

Work through this list before the week is out:

  • Pick one ordinary file per system you back up, with a detail that has changed since the version you will restore
  • Ask one colleague without administrator rights to be the tester and agree on a time
  • Find your backup tool's option to restore to a different location and check who can use it
  • Create the temporary folder in your own My Drive or OneDrive
  • Share it with the tester alone, run the test, check the access, record the result and remove the access
  • Put the next test on the calendar with a different file, system or restorer

Short answers to common follow-up questions

A fresh account does not have to be a new one. The point is to see what an everyday user sees, so use a colleague's normal sign-in on their own device.

A sensitive file needs its own plan. Keep the routine test to ordinary files, and when you must check restricted data, use a tester who is already allowed to see it and restore only to a location with the same restrictions.

Version history and the trash are not a backup. Google Drive permanently deletes items left in the trash for more than 30 days, an administrator can recover them only within 25 days after a user empties the trash, and Google notes that file revisions may occasionally be merged. Google Vault can search and export retained data, but it cannot restore that data directly to a user's Drive.

Your IT provider's restore still needs your tester. CSF 2.0 includes the outcome that improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties (ID.IM-02), and only someone in your office can confirm the file is the one you needed.

Test on a schedule and after changes. CISA advises testing backup procedures on a regular basis; also rerun this test after you change backup tools, move files to new storage or change who runs restores. If you use Microsoft 365 Backup, Microsoft asks that restores for testing stay at no more than twice a month per protection unit, meaning each backed-up OneDrive account, SharePoint site or mailbox; restores for real recovery are not limited.

Where ALCO can help

ALCO USA Inc is an IT services company headquartered in Caldwell, Idaho, with technicians serving businesses across Idaho. Its backup and disaster recovery service backs up mail, OneDrive, SharePoint, Drive and shared drives outside the provider, and ALCO restores real files on a schedule, times each restore and records what worked and what did not. ALCO's services also include Microsoft 365 and Google Workspace. If a test turns up a problem, the ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources