Backup and disaster recovery for a law firm comes down to two promises. First, there are recoverable copies of every system that runs an active matter: the calendar, the case files, email, and the billing and trust records. Second, someone has actually proven those copies come back, in hours that match how your firm works.
That’s the whole job. No “trusted digital transformation partner” required.
We’ve kept Metro Atlanta firms running for thirty years, from solo practices near the Decatur square to partnerships in Buckhead and small litigation shops out in Woodstock. This article covers the parts that matter to a law firm specifically: how a failed backup turns into a malpractice problem, how retention rules reach your backup copies, and what to say to clients when something breaks. If you’re still deciding who should own all this, our piece on IT support built for Atlanta law firms covers the wider relationship.
What Backup and Disaster Recovery Means for a Law Firm
Backup is the copy. Disaster recovery is the plan for using that copy to get people working again, and a firm needs both because a copy nobody knows how to restore is just a very expensive hard drive.
Think of backup as the photocopy of the file and disaster recovery as the instructions for what happens when the original burns: who restores what, in which order, and who tells the clients.
Five systems matter most to a firm. If any of them is gone for a week, you feel it in court dates and in cash flow.
- Email, because court notices, opposing counsel and clients all arrive there.
- The docketing calendar, which holds every deadline you’re responsible for.
- The case file system, meaning the matter folders, pleadings, discovery and work product.
- Billing and trust records, which you must be able to reconstruct accurately.
- The phone line, because a firm that can’t be reached looks like a firm that has closed.
A server room flood, a stolen laptop, a ransomware note on a Monday morning, a staff member who deletes the wrong folder. The cause changes, but the question stays the same: how much do you lose, and how long until you’re working again?
Malpractice Data Loss: How a Lost Case File Becomes a Claim
Data loss alone doesn’t produce a malpractice claim. The claim comes from what the loss causes downstream: a missed deadline, a missing exhibit, a client who learns about the problem from someone else.
The risk sits in the gap between your last good copy and the moment things broke. Everything created in that gap is gone, and nobody can say what was in it, which is exactly why it’s dangerous.
Missed Deadlines Often Start With a Lost or Stale Calendar
Take a typical case. A practice’s docketing database fails on a Thursday, and the restore pulls from a copy that is several days old. The system looks fine, and everyone gets back to work. Nobody notices that the entries added over the previous week are missing until a response deadline has already passed.
Nothing in that story required carelessness. It required a backup that ran, a restore that appeared to work, and no one checking the result against the paper trail.
A court notice stuck in a lost mailbox works the same way. If the notice arrived after the last good copy and before the outage, the only evidence it ever existed may be the court’s own record.
So we treat the calendar and email as the first systems to protect, with the shortest gap between copies. Your malpractice carrier cares about missed deadlines far more than it cares about which brand of backup software you run.
Lost Evidence Turns Into a Sanctions Fight
Once litigation is anticipated, you have a duty to preserve relevant electronically stored information. Losing that information to an ordinary hardware failure doesn’t excuse you if the court decides you didn’t take reasonable steps.
Federal Rule of Civil Procedure 37(e) addresses exactly this: electronically stored information that should have been preserved and was lost because a party failed to take reasonable steps, with harsher remedies when intent is shown. Georgia state courts apply their own spoliation standards, so ask your counsel how they read for your cases.
The practical lesson is that documented reasonable steps matter as much as the system itself. A dated backup log and a restore test record are the kind of paper you want in a drawer.
Before an incident, read your malpractice and cyber policies. Find out what they cover after a data loss, and what notice they require and how fast. Some policies expect prompt notice, and finding that out after the fact is a bad time to learn it.
Case File Retention Rules Have to Reach Your Backups
Your retention schedule doesn’t stop at the live server. Backup copies hold the same client files, so they age out on the same clock as the files they contain, and a litigation hold overrides both until it’s released.
Many firms get this half right. They have a sensible policy for closed files and then keep every backup set forever, which means client data they meant to destroy is still sitting in a vault years later.
We won’t print retention periods here. They vary by practice area and governing rules, so take the specific numbers from your own counsel or from the State Bar of Georgia’s guidance.
What we can tell you is how the mechanics should work. Your backup retention should be set deliberately to match your schedule, and your hold process should reach whoever manages the backups.
Deleting From the Server Doesn’t Delete the Backup
When you purge a closed matter from the server, the backup sets made before the purge still contain it. Those copies stay until the retention setting on the backup itself expires them.
The reverse is the more dangerous case. If a hold is placed on a matter and the routine rotation overwrites the old backup sets, you may destroy the only copy of something you were obliged to keep.
When a hold goes out, tell your IT provider the same day. A hold that reaches the attorneys but not the person who manages the backup rotation is a hold with a hole in it.
Recovery Time for Active Cases, System by System
Vendors love phrases like “enterprise-grade resilience.” It sounds expensive and says nothing. What a firm needs are two numbers per system, and the next subsection translates them.
This is also where we push back on the idea that every file needs the same treatment. A closed matter from 2014 doesn’t need the same protection as the motion due Friday, and paying for the same speed on both is how small firms end up in an enterprise package they never needed.
Recovery Time and Recovery Point in Plain English
Recovery time (the industry says RTO) is how long your firm can be down before the pain becomes unacceptable. Recovery point (RPO) is how much recent work you can afford to lose, measured backward from the moment of failure.
If the calendar is copied every night, your recovery point is up to a day of lost entries. If it’s copied every hour, you lose at most an hour. You pick the number based on what you’d be willing to retype, and what you couldn’t reconstruct at all.
Case File Recovery: Active Matters Come First
Set separate targets for each system that active matters depend on. A reasonable conversation starts with these:
- Calendar and email: the tightest targets, because a missed notice costs the most and is the hardest to detect.
- Open case folders: close behind, since attorneys can’t work without drafts and exhibits.
- Billing and trust records: accurate and current, because reconstructing them later is slow and invites errors.
Closed archives can wait longer and come back more slowly. That’s fine, and it’s cheaper. Whether a case file recovery takes two hours or two days matters a great deal for a matter in trial and barely at all for one closed in 2019.
This approach doesn’t make every system instantly recoverable, and it isn’t meant to. It makes sure the slow, cheap recovery lands on the files that can afford it.
Law Firm Data Backup That Survives Ransomware and Bad Deletes
Attackers know backups are what let you refuse to pay, so they often go after the backups first. A setup that survives ransomware assumes the attacker will get a legitimate admin login and tries to keep the backups out of reach anyway.
The old 3-2-1 idea still holds, in plain English: three copies of your data, on two kinds of media, with one copy offsite. It’s a solid start, but it isn’t enough if all three copies answer to the same password.
Keep One Copy Your Everyday Logins Can’t Reach
At least one copy needs separate admin credentials from the ones your staff and your IT team use every day. Ideally that copy is also immutable, meaning it can’t be altered or deleted for a set period, even by someone holding the keys.
If a stolen password can wipe your production data and your backups in the same afternoon, you effectively have one copy. Ask your provider directly whether that is true of your setup.
Your Cloud Suite Needs Its Own Backup
Many firms assume Microsoft 365 or Google Workspace backs them up. Recycle bins and built-in retention settings are not a full backup. They’re designed for convenience, they expire, and they can be emptied by an account an attacker controls or a departing employee.
Cloud email and your document system hold the same case material as your old file server did. They deserve legal document backup solutions that sit outside the vendor, so recovery doesn’t depend on the same account that failed.
A Backup You Haven’t Restored Is Just a Guess
A green checkmark in a backup dashboard says the job ran. It doesn’t say the data is complete, readable, or restorable on a bad day.
The fix is a restore test, and a dated one. If your reasonable steps are ever questioned, by a court, a client or an insurer, a record showing you restored real data on a specific date is far stronger than a sentence saying you had backups.
ABA Model Rule 1.1’s comment on technology asks lawyers to keep abreast of the benefits and risks of relevant technology, and Rule 1.6(c) asks for reasonable efforts to prevent unauthorized access to client information. Georgia’s rules are built on the ABA model, but check the current Georgia wording before you cite either one. A written backup and restore practice is one concrete way to show you made those efforts.
Test whole matter folders and full mailboxes, not single files. Restoring one Word document proves almost nothing. Restoring an entire active matter, with its subfolders, permissions and the attorney’s mailbox, shows what a real recovery looks like.
Questions to Ask Any Provider, Including Us
Ask these of us and of anyone else. If the answers are vague, you’ve learned something.
- When was the last time you restored a full matter folder and a full mailbox for a client, and can we see the date?
- Which of our backup copies can our everyday admin logins not reach?
- Does our Microsoft 365 or Google Workspace data have a backup outside the vendor?
- Who answers when something breaks at 7 a.m. and do they know our setup?
- Will that same person still be on our account next year?
That last one is where we differ. We’re a family-run company, and the technicians who answer the phone are the people who stay on your account for years rather than rotating through. For a deeper checklist, see choosing a managed IT provider without getting burned. And if you’re leaving a provider who stopped picking up, switching providers without breaking anything explains how to move your backup access and copies across cleanly.
If you want to see where cost lands once you’ve set targets, read what a disaster recovery plan costs for a small business.
Client Trust After an Outage: What You Say and Who Says It
Clients forgive an outage far more easily than they forgive silence. ABA Model Rule 1.4(a)(3) asks lawyers to keep clients reasonably informed about the status of their matters, and that is the standard any message after an outage has to meet. Check Georgia’s current wording of the rule before quoting it.
The managing attorney should send the first message, not the IT vendor. Clients hired the lawyer, and hearing from the lawyer tells them someone responsible is in charge. Keep the tone warm and plain. Skip the snark we reserve for vendors.
Say what is affected, what isn’t, and when the next update is coming. Then send that update on time, even if the only news is that there’s no news.
Route anything touching possible personal-data exposure through counsel before it goes out. Whether a notice obligation exists is a legal question, not a technical one, and the wording matters.
Write the Client Message Before You Need It
Draft the message now, while nobody is panicking. Put in blanks for the date, the affected systems and the next update time, and store a copy somewhere that doesn’t depend on your own email or file server.
During an outage, the phone becomes the main line to your clients. Someone who knows your systems should be answering it, not a ticket queue or an overseas desk reading from a script. For firms rethinking the phone side of this, see a phone setup built for small law firms.
If you’re the managing partner or office manager, the next step is small. Use Get a Quote to talk to a technician about your recovery targets. We’ll walk through which systems hold your active matters and how much downtime each one can take.
Frequently asked questions
Is Microsoft 365 or Google Workspace enough to back up our law firm’s email and documents?
No. Built-in retention and recycle bins are convenience features. They expire, and an account an attacker controls can empty them. Your cloud email and document storage need a separate backup that doesn’t depend on the vendor’s own settings.
Does a litigation hold apply to our backup copies?
Yes. Backups hold the same client files as your live systems, so a hold overrides scheduled destruction on both until it’s released. Tell whoever manages your backup rotation the same day the hold goes out, so old sets aren’t overwritten.
How often should a law firm test its restores?
We recommend testing at least twice a year and after any major system change. Restore whole matter folders and full mailboxes, and keep a dated record of each test. That record is your evidence of reasonable steps.
What’s the difference between recovery time and recovery point?
Recovery time is how long your firm can be down. Recovery point is how much recent work you can afford to lose. Calendar and email need tighter targets than closed archives, which can come back slower.
