When the auditor asked if my backups actually worked, I had a screenshot instead of a shrug

The auditor asked me a question I couldn't answer, and the room got quiet.

"Show me a successful restore."

I had the backup tool configured. I had the jobs running every night. I had the little green checkmark in some admin panel saying everything was fine. What I did not have was any actual proof I'd ever restored anything. I handed them a shrug when I should have been pulling up a screen.

That's the thing nobody tells you about backups. Backing up is the easy ten percent. The other ninety is knowing the thing restores, knowing it restores recently, and being able to say so out loud without crossing your fingers. Plenty of small businesses treat the backup button like a retirement plan, and it goes expensive the exact week they need it.

So I stopped treating restores like an emergency procedure and started treating them like a chore that lands on a schedule, same as rotating logs or patching a server. Every couple of weeks I pick a snapshot, drop it into a scratch folder, and confirm the files that matter actually survived the trip through the archive. Then I write the result down.

Here's the part that sounds small and isn't. I keep that result visible on a small audit dashboard, so "did I actually verify anything this month" isn't a memory game. It's a line that says last verified restore, how big it was, how many files, zero errors. When someone asks if the backups are good, I don't produce a story. I turn the screen around and let the numbers talk.

The command that makes this possible in a way you can point at is boring in the best way:

restic restore 42a1b82c --target /tmp/restest

Then you look in that folder, see your files, log one line saying it worked. That's it. There's no ceremony in a good restore test. There's just a habit you keep and a record to show.

If you want that workflow automated, the stack I've been building does exactly this: an encrypted backup layer that snapshots and audits itself, plus a small dashboard that tells the truth about the last time something came back out of the archive. No SaaS billing, no vendor deciding what "backed up" means, and it runs on a spare laptop. One-time buy over at symshah.gumroad.com/l/smb-security-pack.

The auditor never asked me twice. That's the whole point. People only ask once when your answer is verifiable instead of a vibe.