{"id":1217,"date":"2026-09-24T22:03:17","date_gmt":"2026-09-24T22:03:17","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=1217"},"modified":"2026-09-24T22:03:17","modified_gmt":"2026-09-24T22:03:17","slug":"verifying-backup-integrity-checksums-vps","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/","title":{"rendered":"Verifying Backup Integrity with Checksums Before You Need a Restore"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Most backup failures are not discovered during the outage \u2014 they are discovered during the restore, when it is far too late. A backup job that exits zero every night can still be writing truncated archives, partial database dumps, or files silently altered by a botched sync. Checksums close that gap: they let you prove, cheaply and automatically, that what you stored is exactly what you wrote, months before you need it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What checksums verify \u2014 and what they do not<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A checksum proves that the bytes you read back match the bytes you wrote. It proves integrity. It does not prove that the backup contains the data you expect, that the schema is complete, or that the restore process works. Checksums catch corruption and truncation; they miss logical errors. You need both checksum verification and a periodic restore drill. Use checksums on every backup, restores on a schedule.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Failure mode<\/th><th>Checksum catches it?<\/th><th>Restore drill catches it?<\/th><\/tr><\/thead><tbody><tr><td>Bit rot on storage<\/td><td>Yes<\/td><td>Yes<\/td><\/tr><tr><td>Truncated archive<\/td><td>Yes<\/td><td>Yes<\/td><\/tr><tr><td>Partial database dump<\/td><td>Yes (with dump hash)<\/td><td>Yes<\/td><\/tr><tr><td>Empty or wrong directory backed up<\/td><td>No<\/td><td>Yes<\/td><\/tr><tr><td>Missing table or column<\/td><td>No<\/td><td>Yes<\/td><\/tr><tr><td>Wrong encryption key<\/td><td>Yes (decrypt fails)<\/td><td>Yes<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Generating and storing manifests<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The pattern is simple: hash the artifact at creation time, store the hash somewhere independent of the artifact, and re-verify before every restore. Store the manifest on the same host only if you also replicate it off-host \u2014 a checksum on the machine you are about to lose is worthless.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># create artifact and manifest together\nD=$(date +%F)\ntar czf \/backups\/www-$D.tar.gz -C \/var\/www html\nsha256sum \/backups\/www-$D.tar.gz &gt;&gt; \/backups\/manifest-$D.txt\n\n# database dump with its own hash\nmysqldump --single-transaction --routines db | gzip &gt; \/backups\/db-$D.sql.gz\nsha256sum \/backups\/db-$D.sql.gz &gt;&gt; \/backups\/manifest-$D.txt\n\n# ship both offsite (restic handles this natively)\nrestic backup \/backups\/www-$D.tar.gz \/backups\/db-$D.sql.gz \/backups\/manifest-$D.txt<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A signed manifest is better than an unsigned one. If you have a GPG key, sign the manifest so a corrupted or tampered manifest cannot silently bless a corrupted artifact. For most single-server setups an unsigned manifest on separate storage is sufficient, but signing costs one extra line.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gpg --detach-sign --armor \/backups\/manifest-$D.txt\n# verify later\ngpg --verify \/backups\/manifest-$D.txt.asc \/backups\/manifest-$D.txt<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Verification: where people get it wrong<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Running <code>sha256sum -c<\/code> while the artifact sits on the same disk that produced it proves almost nothing \u2014 a single disk-level corruption affects both files equally. Verification must happen either after reading back from the offsite copy, or against a hash that was transmitted and stored independently.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># correct: verify the copy that was pulled back from offsite\nrestic restore latest --target \/tmp\/verify\ncd \/backups &amp;&amp; sha256sum -c \/tmp\/verify\/backups\/manifest-$D.txt\n\n# verify a restic repository's own integrity\nrestic check --read-data-subset=10%<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>restic check --read-data-subset<\/code> is the pragma for the common case: reading a percentage of the repository each run keeps verification cost bounded while still exercising the actual stored data rather than just metadata. Over a month of daily runs at 10%, every byte of the repository gets re-read and hashed at least once.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Automating verification without alert fatigue<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Daily:<\/strong> verify the manifest of the most recent artifact after upload. Alert only on failure.<\/li><li><strong>Weekly:<\/strong> run a full <code>restic check<\/code> on repository metadata.<\/li><li><strong>Monthly:<\/strong> pull one artifact back from offsite storage and verify against its manifest.<\/li><li><strong>Quarterly:<\/strong> perform an actual restore into a scratch environment and start the service.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Wire the daily check into the backup script itself so verification is impossible to skip, and make failures loud. A checksum mismatch on a fresh backup is a five-alarm event: it means either the source data is changing under you or the storage layer is corrupting writes. Both need immediate investigation before the next run.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/bin\/bash\nset -euo pipefail\nD=$(date +%F)\nsha256sum -c \/backups\/manifest-$D.txt || {\n  logger -t backup \"CHECKSUM FAILURE $D\"\n  mail -s \"BACKUP CHECKSUM FAILURE $D\" ops@example.com &lt;&lt;&lt; \"Manifest verification failed.\"\n  exit 1\n}\nlogger -t backup \"verified $D\"<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Choosing the checksum algorithm<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SHA-256 is the sensible default: fast on modern CPUs, universally available, and strong enough that collisions are not a concern. MD5 is faster but broken for adversarial use; treat it as a legacy compatibility option only. For very large datasets where hashing time matters more than collision resistance, xxHash or BLAKE3 through a dedicated tool performs far better, at the cost of a non-standard utility on every host that reads the manifest.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Verification is cheap insurance, and the whole discipline is three commands and a cron entry. The expensive part is discovering your backups were broken during an incident; the cheap part is a manifest and a weekly check. Pair it with off-host storage you can actually restore from, and the checksum becomes the proof that the last line of defense still holds. If you are designing the backup tier around storage constraints, review our <a href=\"https:\/\/virtualserversvps.com\/\">VPS plans<\/a> to size the offsite and staging capacity correctly before the first restore attempt, and see how <a href=\"https:\/\/virtualserversvps.com\/\">managed versus unmanaged options<\/a> change who keeps the restore drill honest.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verification for object storage and immutable backups<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Object storage adds ETags and content-MD5 headers you can compare against your own manifest. Treat the provider&#8217;s checksum as a second opinion, not a replacement: it proves the object arrived intact at the store, while your manifest proves the artifact was correct before it left the server. When both agree, you have verified the entire chain. When they disagree, the divergence point tells you whether corruption happened in transit or at rest \u2014 which is exactly the information you need to fix the pipeline rather than just re-run it.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>Most backup failures are not discovered during the outage \u2014 they are discovered during the restore, when it is far too late. A backup job that exits zero every night&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":1,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1217","post","type-post","status-publish","format-standard","hentry","category-vps-guides-tutorials"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Verifying Backup Integrity with Checksums Before You Need a Restore - Virtual Servers VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Verifying Backup Integrity with Checksums Before You Need a Restore\" \/>\n<meta property=\"og:description\" content=\"Verifying Backup Integrity with Checksums Before You Need a Restore\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-24T22:03:17+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/\",\"name\":\"Verifying Backup Integrity with Checksums Before You Need a Restore - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-09-24T22:03:17+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Verifying Backup Integrity with Checksums Before You Need a Restore\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Verifying Backup Integrity with Checksums Before You Need a Restore - Virtual Servers VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/","og_locale":"en_US","og_type":"article","og_title":"Verifying Backup Integrity with Checksums Before You Need a Restore","og_description":"Verifying Backup Integrity with Checksums Before You Need a Restore","og_url":"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-09-24T22:03:17+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/","url":"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/","name":"Verifying Backup Integrity with Checksums Before You Need a Restore - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-09-24T22:03:17+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/verifying-backup-integrity-checksums-vps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Verifying Backup Integrity with Checksums Before You Need a Restore"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/1217","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=1217"}],"version-history":[{"count":1,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/1217\/revisions"}],"predecessor-version":[{"id":1218,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/1217\/revisions\/1218"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=1217"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=1217"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=1217"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}