Backup

Data + configuration

1. Select copy. The successful R81 copy contains A1 and A2. A3 was added later. Selecting this copy does not yet show that the restored appointment task will work. R81 contains the original synthetic JSON appointments A1 at 09:00 and A2 at 10:00. It was captured at 07:50 UTC; source record A3 at 11:00 was added at 08:10. R81 cannot supply A3. Production-admin deletion of R81 is denied by the assumed separate access design; this picture supplies no actual storage-permission test.
2. Restore data. The recovery operator restores R81 into isolated T81. A1 and A2 appear after restoration completes, while the retained copy and source stay unchanged. T81 is an authorized test environment with no dependency on the original server. The selected payload is decoded into separate restored data. Both paths restore the same A1 and A2 records and leave R81 unchanged. Restoring data alone does not load the application’s configuration, prove trustworthiness, or measure service recovery time.
3. Open application. This bundle also supplies the required C81 configuration. T81 loads it before the appointment read is tested. C81 identifies the appointments collection needed by this synthetic application. Data and configuration are distinct recovery dependencies. The controlled fixture has no encryption or secret key requirement; real recovery can need keys, identities, software and other dependencies. A loaded configuration is not yet evidence that the business task works.
4. Check recovery. The task reads A1 and A2, but R81 is 70 minutes old at 09:00. It exceeds Nora’s 30-minute limit and omits A3, so the full goal still fails. The independent fixture read returns ["A1","A2"]. Subtracting 07:50 from the fixed 09:00 exercise time gives 70 minutes, greater than the approved 30-minute recovery-point age. Those are scenario requirements, not a universal backup schedule or a measured recovery duration. Usability passed; freshness did not. Nora must arrange an adequate recovery point and repeat the scoped checks.

Data only · no C81

1. Select copy. The successful R81 copy contains A1 and A2. A3 was added later. Selecting this copy does not yet show that the restored appointment task will work. R81 contains the original synthetic JSON appointments A1 at 09:00 and A2 at 10:00. It was captured at 07:50 UTC; source record A3 at 11:00 was added at 08:10. R81 cannot supply A3. Production-admin deletion of R81 is denied by the assumed separate access design; this picture supplies no actual storage-permission test.
2. Restore data. The recovery operator restores R81 into isolated T81. A1 and A2 appear after restoration completes, while the retained copy and source stay unchanged. T81 is an authorized test environment with no dependency on the original server. The selected payload is decoded into separate restored data. Both paths restore the same A1 and A2 records and leave R81 unchanged. Restoring data alone does not load the application’s configuration, prove trustworthiness, or measure service recovery time.
3. Open application. The same data restoration succeeds, but this bundle omits C81. T81 cannot open the required appointment collection. The data-only counterexample changes just the presence of C81 configuration. A1 and A2 were restored correctly and R81 remains unchanged. The synthetic application requires a configuration naming the appointments collection, so a missing C81 produces an explicit configuration error. The animation does not silently add the missing dependency.
4. Check recovery. The appointment read reports a configuration error. The unchanged copy is also too old. A successful data-copy job has not met either recovery check. The fixture task cannot enumerate appointments without C81, so it records a configuration error rather than claiming an empty or usable appointment list. R81 remains 70 minutes old at the fixed 09:00 exercise time and lacks A3. Dependency repair and a sufficiently current recovery point remain open. This failure does not negate the separately completed data restoration.

Neither path meets Nora’s full recovery goal. Even a working read uses a 70-minute-old copy without A3. Protection permissions are assumptions, not a storage audit. No production outage, recovery-time result, corruption check, or reversal of an earlier disclosure is established.

Flow references: CIS Control 11: Data Recovery · NIST SP 800-34 Rev. 1: recovery objectives and testing