Most conversations about data recovery happen at the worst possible moment, usually a Monday morning, usually with someone in tears. This post is the conversation we wish we could have with every business owner before that moment.
It's structured as an FAQ because that's how it actually comes up: a long list of questions, asked in a panic. Better to think about them now.
What's the difference between backup and recovery?
Backup is making the copy. Recovery is restoring from the copy when something goes wrong.
Most businesses we audit have backups. Far fewer have actually tested their recovery, and an untested backup is a hope, not a plan. We test recovery quarterly for clients on our managed IT support service.
What does "RTO" and "RPO" mean and why should I care?
Two acronyms worth knowing because they shape the cost of your backup setup:
- RTO (Recovery Time Objective), how long you can be down before it really hurts. Four hours? A day? A week?
- RPO (Recovery Point Objective), how much data you can afford to lose. The last hour's work? A day's? A week's?
Tighter RTO/RPO costs more (more frequent backups, faster restore infrastructure). The right answer is the cheapest setup that meets the business's actual tolerance, not a one-size-fits-all package.
What are the most common reasons businesses lose data?
In rough order of frequency from what we see:
- Accidental deletion, someone deletes a file/folder/SharePoint site without realising
- Ransomware, files encrypted, often including any backups stored on the same network
- Hardware failure, server disk dies, laptop is stolen, RAID controller fails
- Cloud sync gone wrong, OneDrive/SharePoint conflicts, mass deletion that syncs everywhere
- Departing staff, accounts deleted before mailboxes/files are archived
- Microsoft 365 misconceptions, assuming Microsoft backs up your data forever (they don't, see below)
Does Microsoft 365 back up my data?
No, not in the way you think it does. Microsoft replicates your data across data centres for their uptime. They have limited retention for accidental loss, typically 30 days for deleted items, 93 days for deleted users. After that, it's gone.
Microsoft's shared responsibility model puts the responsibility for backing up and recovering your data on you. Their official guidance recommends a third-party backup tool. We deploy this for every Microsoft 365 client by default, covered on our cloud support page.
What does ransomware actually do to backups?
Modern ransomware specifically targets backups. It will:
- Encrypt backup files stored on network shares
- Delete shadow copies on Windows
- Attempt to access cloud backup credentials saved on infected machines
- Disable backup software services
The defence is air-gapped or immutable backups, copies that the ransomware physically can't reach. We use cloud backups with immutability enabled and offline copies for critical data. The cyber security page covers the wider ransomware defence picture.
How long does data recovery actually take?
Honest ranges, assuming your backups are sound:
- Single deleted file from Microsoft 365: minutes
- Mailbox restore (one user): 30 minutes - 2 hours
- Server file share (1TB): 4-12 hours from cloud, 1-2 hours from local backup
- Full server (bare metal): 4-24 hours
- Full ransomware recovery (multiple servers + endpoints): 3 days to 3 weeks depending on prep
If you have no recent backups? Specialist disk recovery firms can sometimes recover from physically damaged drives, but it's £1,000s per device and there are no guarantees.
Will my cyber insurance cover ransomware?
Not always, and rarely as much as people assume. Most policies in 2025 require:
- MFA on all admin accounts (and often all accounts)
- Endpoint detection and response (EDR), not just antivirus
- Tested, immutable backups
- A documented incident response plan
- Patching SLAs (often 14-day critical, 30-day other)
- Security awareness training for all staff
If you can't evidence those, the policy may not pay out. We help clients prepare for and pass cyber insurance audits, see IT consultancy.
What questions should I ask my current IT provider?
If you're currently outsourced and you're unsure where you stand, ask these:
- What's our RTO and RPO, agreed in writing?
- When did we last test a full recovery, and where's the report?
- Where are our Microsoft 365 backups held, and for how long?
- Are our backups immutable / air-gapped from ransomware?
- If our office burned down tonight, how would we be working tomorrow morning?
- Do we have a documented disaster recovery runbook, and who has access to it?
A good provider will have written answers ready. A vague provider is the warning sign.
What should I do today, before anything goes wrong?
Three things, in order:
- Confirm in writing what's being backed up, Microsoft 365, file servers, line-of-business apps, databases. All of them.
- Ask for the most recent recovery test report. If there isn't one, that's the problem you need to fix first.
- Make sure backups are immutable and off-site, protected from ransomware and physical disasters.
Need someone to actually check?
We do free 30-minute backup health checks for businesses across Birmingham and the West Midlands, just a conversation about what you've got, what you don't, and what to fix first. Book a call or read more on our IT support page.