Hacker News Reader

My snapshots are encrypted by the original computer (this is cool because the NAS can’t read them!). So I also needed to restore the encryption “wrapper key” to be able to use the backups.

Not gonna lie, it was pretty terrifying until I had my first confirmation I could decrypt the data.

Note: no bespoke backup method should be assumed functional unless you actually periodically check that you can restore data from it.

View on HN

Or non-bespoke.

I added that word because at least with non-bespoke backups, you have probably thousands of users each day testing restoration out of necessity, and word might get around if the method failed to restore. But nevertheless, one should still test even then.

In short, backups aren't actually taken until they have been verifiably restored.

I always see this advice but...how do you even do that without having an entire additional set of disks to restore too?

You can't restore to production obviously, as aside from the downtime if the test fails you've just destroyed your good copy and proved the other copy is also bad.

About the best I can think of is restoring a small part of the set as a sample, which isn't really testing the whole thing.

I always meant to keep a copy of my LUKS header on separate disk, just in case, but..

Reply on news.ycombinator.com