validating-backup-integrity-for-recovery

# Validating Backup Integrity for Recovery ## When to Use Use this skill when: - Verifying backup integrity before relying on backups for ransomware recovery - Building automated backup validation pipelines that run after each backup job - Auditing backup infrastructure to confirm recoverability for compliance (SOC 2, ISO 27001, NIST CSF RC.RP-03) - Detecting silent data corruption (bit rot) in backup storage before a disaster occurs - Validating that immutable or air-gapped backups have not been tampered with **Do not use** for initial backup configuration or scheduling. This skill focuses on post-backup validation. ## Prerequisites - Access to backup storage (local, NAS, S3, Azure Blob, GCS) - Python 3.9+ with `hashlib` (standard library) - Backup manifests or baseline hash files for comparison - Isolated restore environment for restore testing - Backup tool CLI access (restic, borgbackup, rclone, or vendor-specific) ## Workflow ### Step 1: Generate Baseline Hash Manifest Create a cryptographic fingerprint of every file at backup time: ```bash # Generate SHA-256 manifest for a directory find /data/production -type f -exec sha256sum {} \; > /manifests/prod_baseline_$(date +%Y%m%d).sha256 # Verify manifest format head -5 /manifests/prod_baseline_20260319.sha256 # e3b0c44298fc1c149afbf4c8996fb924... /data/production/config.yaml # a7ffc6f8bf1ed76651c14756a061d662... /data/production/database.sql ``` ### Step 2: Verify Backup Archive Integrity Check that the backup...