Backup & Disaster Recovery Center
Backup diagnostics for restore, immutability, replication, RPO/RTO and capacity.
vssadmin list writersvssadmin list providersvssadmin list shadowstorageGet-VolumeGet-PhysicalDiskGet-NetAdapterStatisticsGet-VM | Get-SnapshotGet-Datastore | Select Name,CapacityGB,FreeSpaceGBdf -hdu -sh <CHEMIN>Get-FileHash <FICHIER>Test-Path <CHEMIN_BACKUP>RPO / RTO calculation
Capacity estimate
Center mission
8 playbooksTroubleshoot backups while protecting restore chains first: job, source, snapshot/VSS, repository, retention, immutability and restore testing before any deletion.
Quick triage
- Identify the last actually successful restore point.
- Read job error code and exact failing stage.
- Check repository capacity and health before retry.
- On Windows, check VSS writers/providers if snapshot fails.
- Never manually purge a chain without understanding retention.
Decision tree
Fix writer/provider/space before backup engine.
Inspect repository, network, quota and chain.
Perform isolated restore test: job success does not equal validated restore.
Measure gap, secure a new restore point then analyze cause.
Intervention playbooks
Start read-only, collect evidence, then change one variable at a time.
01Backup job failedRead-only
Job becomes Failed/Warning or does not reach latest restore point.
Checks
- Read first causal error, not only final line.
- Check source reachability and credentials.
- Check repository, quota and network.
Commands / evidence
Get-Service VSSGet-Volume | Sort-Object SizeRemainingTest-NetConnection <repository> -Port <port>Expected result
Failing stage is identified: source, snapshot, transfer or repository.
Corrective actions
- Fix first cause then rerun a controlled job.
- Keep logs and job ID before cleanup.
Escalate when
Critical restore chain, suspected corruption or multiple jobs fail simultaneously.
02VSS writer errorControlled change
Windows snapshot fails with writer Failed/Retryable error.
Checks
- List all writers and note failing writer.
- Check associated service and VSS/SPP events.
- Check shadow storage and free space.
Commands / evidence
vssadmin list writersvssadmin list providersvssadmin list shadowstorageGet-WinEvent -LogName Application -MaxEvents 100 | ? ProviderName -match "VSS|SPP"Expected result
All critical writers are Stable / No error before new backup.
Corrective actions
- Restart only related service if procedure and impact are controlled.
- Avoid blind reboot before identifying writer.
Escalate when
Critical database application writer, recurring errors or third-party provider.
03Repository nearly fullIntrusive / escalation
Backups fail due to space or retention no longer frees enough.
Checks
- Measure capacity, growth and margin needed for next job.
- Understand full/incremental chain and retention.
- Check storage snapshots/object lock preventing purge.
Commands / evidence
Get-Volume | Sort-Object SizeRemainingGet-ChildItem <repo> -Directory | Sort-Object LastWriteTimefsutil volume diskfree <drive>Expected result
Enough capacity exists to complete job plus merge/retention without breaking chain.
Corrective actions
- Extend repository or reduce retention through backup software.
- Never directly delete chain files.
Escalate when
Immediate critical space, immutability prevents purge or chain depends on old files.
04Expected restore point missingRead-only
Required date/time does not appear in console or catalog.
Checks
- Compare schedule, job history and retention.
- Check whether job was disabled, skipped or failed.
- Check copy/offsite job if second copy expected.
Commands / evidence
Get-DateGet-ScheduledTask | ? TaskName -match "backup"Get-WinEvent -LogName System -MaxEvents 100Expected result
Each expected RPO interval maps to a restore point or documented failure.
Corrective actions
- Secure a new full point if gap remains open.
- Fix scheduling/monitoring that missed the gap.
Escalate when
Contractual RPO breached, points lost to corruption or business need falls in missing window.
05Restore failsIntrusive / escalation
Restore point is visible but file/VM/database restore fails or produces unusable data.
Checks
- Test another point and isolated target.
- Read read/checksum/permission/space error.
- Check application dependencies after restore.
Commands / evidence
Get-FileHash <restored-file>Get-VolumeTest-Path <restore-target>Expected result
Restore produces readable, validatable data without altering production.
Corrective actions
- Always validate in isolated area before production overwrite.
- Test multiple points to bound possible corruption.
Escalate when
Multiple points unreadable, critical business database or irreversible overwrite considered.
06RPO breachedIntrusive / escalation
Latest valid backup is older than business objective.
Checks
- Calculate exact age of last valid point.
- Identify data changed since that point.
- Check whether another copy or replication covers gap.
Commands / evidence
Get-DateGet-Item <last-backup> | Select LastWriteTimeGet-VolumeExpected result
Protection gap is quantified and immediate action reduces risk.
Corrective actions
- Trigger a protected point as soon as source/repository is healthy.
- Notify according to procedure if SLA/RPO is breached.
Escalate when
Business RPO breached on critical system or no secondary copy available.
07Ransomware suspicion — protect backupsIntrusive / escalation
Encryption, mass deletion or compromised account threatens repository/console too.
Checks
- Check immutability/offline copy without unnecessarily mounting backups.
- Identify accounts with repository/console access.
- Freeze automatic deletions/retention if procedure allows.
Commands / evidence
Get-SmbSessionGet-SmbShareAccess -Name <share>Get-LocalGroupMember AdministratorsExpected result
At least one healthy, isolated, immutable copy is preserved.
Corrective actions
- Isolate backup paths from incident before restoring.
- Rotate backup credentials from a clean endpoint per response plan.
Escalate when
Repository encrypted, immutability uncertain or active attack on backup infrastructure.
08DR test / restore validationControlled change
Backups are green but no recent restore has proven DR capability.
Checks
- Choose representative workload and isolated environment.
- Define RTO/RPO and success criteria before test.
- Test identity, network, application and data consistency.
Commands / evidence
Get-DateTest-NetConnection <restored-service> -Port <port>Get-FileHash <reference-file>Expected result
Restored service starts within RTO and data matches expected point.
Corrective actions
- Document time gaps, dependencies and manual steps.
- Update DR plan with test findings.
Escalate when
RTO/RPO not met or restore depends on undocumented knowledge.
End-of-intervention checklist
- Confirm a new valid restore point after fix.
- Check repository, retention and second copy.
- Perform at least one restore check where relevant.
- Document actual RPO and job incident.
- Ensure monitoring will alert on next anomaly.