Sound familiar?
- Someone deleted a folder in SharePoint and nobody knows when
- Your backup emails have said 'warning' or 'failed' for weeks
- The only backup is a USB drive that stays plugged into the server
- A laptop died and the files were only on its Desktop
- Ransomware has encrypted the shared drive
- You are not sure whether Microsoft 365 backs up your email
Key facts
- The 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off site
- Microsoft 365 recycle bins and retention are not an independent backup
- SharePoint and OneDrive keep deleted items in recycle bins for 93 days
- Immutable or offline backup copies cannot be encrypted by ransomware that reaches your network
- A backup is only proven once a test restore has succeeded
- Recovery work is £45 an hour + VAT; backup set-ups are quoted
What needs backing up
Most small businesses have data in more places than they think:
- Microsoft 365: Exchange mailboxes, OneDrive, SharePoint sites and Teams files.
- Servers and NAS devices: shared drives, databases and the system state needed to rebuild a domain controller.
- Laptops and desktops: anything saved to the Desktop or a local folder that is not synced.
- Line-of-business software: accounts, CRM, practice management or job-tracking systems, which often keep their data in a local database.
- Your website: covered by our website plans, which include daily backups from £25 a month + VAT. See website backups.
Why Microsoft 365 is not a backup on its own
Microsoft runs a shared responsibility model: it keeps the service available and protects against its own hardware failing, but looking after your data is your job. The built-in safety nets are useful: OneDrive and SharePoint version history, a recycle bin that keeps deleted items for 93 days, and recoverable items in Exchange. They do not help if a deletion is noticed after the retention window, if a leaver's account is removed and their OneDrive expires, or if ransomware syncs encrypted files over the top of good ones across many folders.
An independent Microsoft 365 backup copies mail, OneDrive, SharePoint and Teams data to separate storage, so you can restore a single email or a whole site to a point in time. We set this up, check the jobs, and run test restores.
Designing backups that survive ransomware
The UK Government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 43% of businesses reported a cyber security breach or attack in the previous 12 months. Ransomware is rarer than phishing, but when it hits, it goes after backups first: mapped backup drives, NAS shares with the same admin password, and USB disks left connected.
We design backups so at least one copy is out of reach:
- Immutable cloud storage with object lock, so backups cannot be changed or deleted for a set period.
- Separate credentials for the backup system, not your normal admin account, with MFA turned on.
- NAS snapshots on Synology or QNAP, which give fast rollback for encrypted shares.
- Off-site copies, either cloud or a rotated drive that is physically disconnected.
If you have been hit already, see ransomware recovery.
Recovery: what we do when data is lost
When something goes missing, speed and calm matter more than anything. We start by stopping further damage: pausing sync clients, isolating infected machines, and checking whether the data is in a recycle bin or previous version before touching backups. Then we restore to an alternative location first, so a bad restore never overwrites the only good copy.
We can recover deleted SharePoint libraries, restore OneDrive to an earlier date with OneDrive's Restore feature, pull single items from Exchange recoverable items, roll back NAS snapshots and restore servers from image backups. We cannot work miracles on a physically failed drive with no backup, but we can tell you honestly whether a specialist data recovery lab is worth trying.
Recovery point and recovery time
Two questions shape any backup design. How much work can you afford to lose (your recovery point)? And how long can you be without the system (your recovery time)? A nightly backup means up to a day of lost work. If that is too much for your accounts system, we add more frequent snapshots.
Testing and cost
We recommend a test restore at least every quarter: one file, one mailbox and, for servers, a full system boot in a sandbox. We record what was restored and how long it took, which also gives you real recovery time figures for insurers and for Cyber Essentials readiness.
Backup set-ups are quoted, including any third-party backup licences. Recovery and one-off fixes are £45 an hour + VAT, with a 30-minute minimum. On the Complete plan at £99 a month + VAT, backup checks can be part of your 3 monthly hours along with helpdesk support. See plans and pricing.
Frequently asked questions
Does Microsoft back up my Microsoft 365 data?
Microsoft keeps the service running and offers version history, recycle bins and recoverable items, but these expire and are not an independent backup. SharePoint and OneDrive recycle bins keep items for 93 days. dijitul recommends a separate Microsoft 365 backup that you can restore from at any point.
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of storage, with one copy off site. Many businesses now add a fourth rule: one copy must be immutable or offline so ransomware cannot touch it. dijitul designs small business backups around this approach.
How often should we test our backups?
At least every quarter, and after any major change such as a new server or migration. A test should restore real files to a separate location and confirm they open. dijitul runs and records test restores so you know your backups actually work.
Can you recover a deleted SharePoint folder?
Usually, yes. If the deletion was within 93 days it is normally in the SharePoint recycle bin or second-stage recycle bin. After that, it depends on having a separate backup. dijitul can restore the folder, its versions and its permissions, at £45 an hour + VAT.
Is a USB drive a good enough backup?
Only if it is rotated and unplugged. A drive left connected to a server or PC can be encrypted by ransomware along with everything else, and it fails without warning. dijitul recommends combining local copies with immutable cloud backup.
How much does backup and recovery cost?
Backup set-ups are quoted, including any backup software or storage licences. Recovery work and one-off fixes are £45 an hour + VAT, with a 30-minute minimum. Ongoing backup checks can sit within the Complete plan at £99 a month + VAT.
Related
Tell us what you need
We scope it, give you a clear fixed quote and do the work. No jargon.