A decade ago, the backup conversation at most law firms ended at the tape drive. Someone swapped media on Fridays, a light blinked green, and the managing partner assumed the firm was covered. Today the mechanics look nothing like that.
Backups run continuously to cloud targets, snapshots pile up by the hour, and dashboards report success rates in the high nineties. What hasn't changed is the moment of truth: nobody tries to restore anything until the server is already down.
That's the shortcut this piece is about. Not a single bad purchase, but a pattern of technology decisions that look prudent on the invoice and only reveal their real price during an outage. The untested backup is the cleanest example, so it's the one to hold in mind throughout.
The Restore Nobody Rehearsed
The failure almost never starts with the backup itself. It starts with the assumption that a green checkmark in a console is the same thing as a working recovery. A firm learns the difference at the worst possible moment: a Monday morning, filings due, and the server refusing to boot.
The IT contractor pulls the most recent snapshot and something is off. The database is there, but the matter management application won't attach it, the document store restored without the index that makes documents findable, and email came back to a point three days before the outage.
None of that is unusual. It's the ordinary result of never having done the drill. Mature contingency planning frameworks treat backup, recovery, and testing as three separate obligations for exactly this reason. A backup you've never restored is closer to a hopeful assumption than a plan.
Cheap Hardware Writes the First IOU
Look upstream from the failed restore and the same shortcut shows up in hardware. Firms buying laptops and servers on sticker price alone often end up with equipment that was never specified for the workload sitting on it — no redundant drives, warranties that lapsed without anyone noticing, storage controllers that vendors stopped patching two years ago. When that hardware is what holds the primary copy of client data, the backup strategy has to compensate for a foundation that was undersized on day one. Guides to common law firm technology missteps have been making this exact point for years, and the shortcut still sells because the savings are visible on the quote and the consequences aren't.
Security Is the Same Shortcut in a Different Costume
Ransomware turns the untested backup from an operational embarrassment into an ethics problem. When attackers encrypt live systems and the firm reaches for its backups, that's often the first real test those backups have ever faced. If the restore fails, the choice narrows to paying a ransom or telling clients their files are gone.
Bar associations haven't been subtle about the duty this creates. Washington State's disaster planning guide for lawyers warns that failing to prepare for a data loss event can itself expose attorneys to discipline or malpractice exposure, and it calls out backups of case files, deadlines, and contact information as non-negotiable.
The ABA Says the Quiet Part Out Loud
The professional duty is more specific than most partners realize. In its guidance on virtual practice, the bar's national body has said that lawyers must ensure client data is regularly backed up and that secure access to that backup data is readily available in the event of loss.
Holland & Knight's read of the opinion puts it plainly: having a backup somewhere isn't enough. The lawyer has to be able to get to it. That single sentence disqualifies most of the arrangements small and mid-size firms run — the ones where the only person who knows the recovery credentials is a contractor who stopped answering emails eighteen months ago.
Software Is Capability, Not a Cost Line
The same instinct that leaves backups untested treats software as a line item to squeeze rather than a system that either works under stress or doesn't. Practice management, document handling, and the tooling around them are what decide whether a firm can execute the recovery it planned for on paper. Buying them on price, or bolting together the cheapest subscriptions available, gets a firm through a slow quarter. It doesn't get a firm through the Monday when the server won't boot.
The answer isn't more spending; it's changing what gets tested. Pick one matter, one mailbox, one document set, and try to restore it from scratch before anything breaks.
Whatever fails in the drill is what would have failed in the outage. Better to find that out with coffee in hand than at 7 a.m. with a filing deadline.