Ransomware restore drills
Restores a real server from backup on a schedule and times the rebuild, so recovery time is measured rather than assumed.
Tools
Veeam, Cohesity, CrowdStrike Falcon, Jira Service Management
Outcomes
Measured recovery time per server tier • Documented dependencies and credentials • Drill evidence attached to the result
Documentation
Instruction-ready detail below
Backup jobs report success because the job finished, not because a file came back. The first real restore test happens during an outage, when the missing credential, the slow link, the wrong file selection and the undocumented dependency all surface at the same time.
The workflow runs the drill on a schedule and treats it as a measured event. It picks a representative server for each tier, restores it to an isolated network, and records the time for each step separately: finding the right restore point, fetching the data, rebuilding the host, and bringing the service back. Anything missing is written into the runbook the same day rather than at the next review. It also opens the break-glass credentials a real recovery would depend on, because a vault nobody has used in a year is not a plan. The result is a written recovery time per tier with an owner against every open gap.
A human approves the drill scope and signs the result.