Lion Cipher Lab
Detect silent backup corruption with a hash manifest
- Cyber / Security Engineer
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A backup you have never verified is a hope, not a control. Files on a backup drive or in object storage can degrade without anyone touching them: a bad disk sector, a failing controller, a torn write during a crash, or cosmic-ray bit rot can flip bytes silently. The file's size and modification date stay exactly the same, so every check that relies on those — which is most of them — reports the backup as fine, right up until the day you try to restore and the archive will not open. NIST's contingency planning guide (SP 800-34) builds its whole model on backups you can actually recover from,…
What you'll learn
- recording a per-file hash manifest (SHA-256 + size + mtime)
- verifying a backup set against that manifest
- telling a legitimate CHANGE from silent CORRUPTION
- catching missing and untracked files
- why the manifest must live apart from the data
- the limits of integrity checking versus a real restore
Steps in this lab
- Why size and date are not enough
- Record a manifest, then verify
- Run it: five findings, one of them silent
- Put it to work, and the limits