<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-backup-integrity-validation
description: >-
  Validate backup integrity for ransomware recovery readiness. Covers
  cryptographic hash verification, automated restore testing, backup chain
  validation, corruption detection, backup isolation verification, and
  recovery time objective (RTO) measurement. Supports Veeam, Commvault,
  Restic, BorgBackup, and cloud-native backup solutions.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - backup-integrity
  - restore-testing
  - hash-verification
  - veeam
  - restic
  - borgbackup
  - rto-validation
  - disaster-recovery
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1490"]
---

# Implementing Backup Integrity Validation

## Overview

Backups are the primary ransomware recovery mechanism, but only if they are
intact. Ransomware operators specifically target backup infrastructure —
deleting shadow copies, corrupting backup agents, and encrypting backup
repositories. Validation ensures backups are complete, uncorrupted, and
restorable within the required RTO.

Key principle: an untested backup is not a backup.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Restic | Backup with integrity checks | `apt install restic` |
| BorgBackup | Dedup backup with verify | `apt install borgbackup` |
| sha256sum | Hash verification | Built-in |
| Veeam SureBackup | Automated restore test | Veeam B&R Enterprise |
| AWS CLI | S3 backup validation | `pip install awscli` |

## Key Concepts

### Backup Validation Levels

| Level | Method | Frequency | Confidence |
|-------|--------|-----------|------------|
| L1 | Job completion check | Every backup | Low |
| L2 | Checksum verification | Daily | Medium |
| L3 | Automated restore test | Weekly | High |
| L4 | Full DR recovery drill | Quarterly | Highest |

### Common Backup Corruption Vectors

```
Ransomware-induced corruption:
├── Encryption of backup repository files
├── Deletion of VSS shadow copies
├── Corruption of backup catalog/metadata
├── Backup agent credential compromise
├── Network share encryption (SMB-accessible backups)
└── Cloud backup API key theft → deletion

Non-malicious corruption:
├── Storage media degradation (bit rot)
├── Interrupted backup jobs
├── Deduplication database corruption
├── Backup chain breaks (missing incremental)
└── Software bugs in backup agent
```

## Workflow

### Step 1 — Cryptographic Hash Validation

```bash
# Generate baseline hashes at backup time
find /backup/latest/ -type f -exec sha256sum {} \; > /backup/manifests/backup-$(date +%F).sha256

# Verify backup integrity against manifest
sha256sum -c /backup/manifests/backup-2026-03-17.sha256 | grep -v ": OK$"

# Compare manifests across backup generations
diff /backup/manifests/backup-2026-03-16.sha256 \
     /backup/manifests/backup-2026-03-17.sha256
```

### Step 2 — Restic Backup Verification

```bash
# Check repository integrity
restic -r /backup/restic-repo check

# Deep check including data blobs
restic -r /backup/restic-repo check --read-data

# Verify specific snapshot
restic -r /backup/restic-repo check --read-data-subset=5%

# List snapshots with stats
restic -r /backup/restic-repo snapshots --json | \
  python3 -c "import sys,json; [print(f'{s[\"short_id\"]} {s[\"time\"]} {s[\"hostname\"]}') for s in json.load(sys.stdin)]"

# Test restore to isolated path
restic -r /backup/restic-repo restore latest --target /tmp/restore-test/
```

### Step 3 — BorgBackup Verification

```bash
# Verify repository integrity
borg check /backup/borg-repo

# Verify with repair (use cautiously)
borg check --verify-data /backup/borg-repo

# List archives with stats
borg list /backup/borg-repo

# Test extract specific archive
borg extract --dry-run /backup/borg-repo::backup-2026-03-17

# Verify specific archive data
borg check --verify-data /backup/borg-repo::backup-2026-03-17
```

### Step 4 — Automated Restore Testing

```bash
#!/bin/bash
# automated-restore-test.sh — Weekly restore validation
set -euo pipefail

RESTORE_DIR="/tmp/restore-test-$(date +%s)"
REPORT="/var/log/backup-validation/restore-$(date +%F).json"
START_TIME=$(date +%s)

mkdir -p "$RESTORE_DIR" "$(dirname "$REPORT")"

# Restore latest backup
restic -r /backup/restic-repo restore latest \
  --target "$RESTORE_DIR" 2>/dev/null

END_TIME=$(date +%s)
DURATION=$((END_TIME - START_TIME))

# Validate restored files
TOTAL_FILES=$(find "$RESTORE_DIR" -type f | wc -l)
ZERO_BYTE=$(find "$RESTORE_DIR" -type f -empty | wc -l)

# Generate report
cat > "$REPORT" <<EOF
{
  "timestamp": "$(date -Is)",
  "restore_duration_seconds": $DURATION,
  "total_files_restored": $TOTAL_FILES,
  "zero_byte_files": $ZERO_BYTE,
  "status": "$([ "$ZERO_BYTE" -eq 0 ] && echo 'PASS' || echo 'WARN')"
}
EOF

# Cleanup
rm -rf "$RESTORE_DIR"
cat "$REPORT"
```

### Step 5 — Cloud Backup Validation (S3)

```bash
# Verify S3 Object Lock (immutability)
aws s3api get-object-lock-configuration \
  --bucket backup-bucket-prod

# Check object versions for unexpected deletions
aws s3api list-object-versions \
  --bucket backup-bucket-prod \
  --prefix "backups/" \
  --query 'DeleteMarkers[?LastModified>=`2026-03-10`]'

# Verify object integrity via ETag/checksum
aws s3api head-object \
  --bucket backup-bucket-prod \
  --key "backups/latest/full-backup.tar.gz" \
  --checksum-mode ENABLED
```

## Detection

```yaml
title: Backup Integrity Validation Detection
id: 40cf372b-63a8-4c5b-b582-58ece035a0f1
status: experimental
description: Detects suspicious activity related to implementing backup integrity validation techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1490
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] Cryptographic hashes generated for every backup job
- [ ] Automated integrity check runs daily (L2)
- [ ] Weekly restore test completes within RTO
- [ ] Quarterly DR drill validates full environment recovery
- [ ] Zero-byte and corrupted file detection automated
- [ ] Cloud backup immutability confirmed (Object Lock enabled)
- [ ] Backup validation failures trigger immediate alert

## References

- NIST SP 800-34: Contingency Planning Guide
- CISA Ransomware Guide: Backup Best Practices
- CIS Control 11: Data Recovery
- Restic Documentation: https://restic.readthedocs.io
- BorgBackup Documentation: https://borgbackup.readthedocs.io
