Test recovery before the case depends on it
A backup is useful only if the firm can locate it, authenticate, restore it into an isolated destination and verify the recovered set. Password reset for an account or application may not decrypt an archive created with a forgotten secret.
The coordinator selects a representative encrypted discovery set, restores it from separately stored media into an isolated workspace, authenticates with the documented recovery material, compares hashes and counts, and records residual files after cleanup.
Run the control in five steps
- 01Select a representative backup and documented recovery materials.
- 02Restore into an isolated destination without overwriting live work.
- 03Authenticate, open representative formats and verify integrity.
- 04Compare manifest, counts and hashes with the approved set.
- 05Clean the test area and record corrective actions.
Preserve a defensible decision trail
Keep backup ID, date, storage location, encryption/version, tester, recovery material source, destination, file counts, hashes, errors, elapsed time, cleanup and approval.
Stop and investigate when
- Only backup creation—not restoration—has been tested.
- The sole password holder is unavailable.
- Restore testing overwrites the active matter workspace.
State what the control does not prove
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Validate preservation, authorization, plaintext copies, provider controls and recovery separately.
Legal discovery security questions
Does changing a forgotten password unlock an old archive?
Do not assume it. Test the product’s version-specific recovery behavior before reliance.
How often should recovery be tested?
At a frequency driven by matter risk, change and retention policy, and after material workflow changes.
Sources for this decision
Links support specific control decisions and do not imply endorsement.