Start with an inventory
List the database, uploaded objects, application configuration, required extensions, roles and external dependencies. For each item, record the owner, recovery artifact and restoration instruction. Use descriptions rather than pasting secrets into a worksheet. A missing item is a coverage question, not a reason to assume the backup tool will discover it.
Trace one user task
Choose a representative action such as opening an order with its uploaded attachment. Ask which systems must exist for that action to work after restoration. This reveals gaps that a database row count can miss. Keep the rehearsal isolated so it cannot send real emails or trigger production payments.
Mark inclusion explicitly
Use included, separately protected, excluded or unknown for every item. Record the source of the decision and when it was checked. An unknown extension requirement should remain visible until a supported restore confirms it. Do not convert a diagram arrow into evidence of coverage.
Fictional example
A restored orders table contains the correct attachment identifiers, but the object bucket was never copied. The application opens the order but cannot display the file. The database restore may have passed its narrow test; the application recovery did not. Add an owned asset-recovery step rather than claiming the entire system is protected.
A small coverage register you can copy
Use five columns: recovery item, status, artifact, owner and acceptance check. Fictional entries: orders database—separately protected—approved dump reference—database owner—sample order opens; attachments—unknown—no artifact identified—application owner—sample file can be read; notification settings—excluded from live use—approved non-production configuration—exercise owner—no real message sent. This register is not an automatic scanner. Review it with the people responsible for the application and update it when dependencies change. A missing owner is itself a finding, even when a backup file exists.
Sources used for this page
These records support the facts and comparisons above. Merchant-controlled records are labelled so you can separate product claims from independent evidence.
- PostgreSQL: backup and restore — Platform documentation · postgresql.org · Merchant-controlled · checked 2026-10-01
- SimpleBackups database backup overview — Merchant documentation · simplebackups.com · Merchant-controlled · checked 2026-10-01