Windows File-Share Backup Artifact Freshness Audit with PowerShell

Expected Outcome

A read-only report identifies expected backup artifacts that are fresh, stale, missing, or unreadable, while explicitly separating artifact freshness from authoritative backup-job and restore status.

Assumptions

• A documented backup artifact location and naming/layout convention

• A defined freshness threshold based on the actual backup schedule

• Read access to the artifact location

• The authoritative backup product/job history remains the source for job success; this lab does not infer job state from source-file LastWriteTime

Bill of Materials

• Windows Server

• PowerShell ISE or any text editor for scripting

• Access to file share locations

Build Steps

1. Define what artifact is expected

   Document the exact path/pattern, expected cadence, minimum size or marker where appropriate, and the backup product/job that is supposed to create it. Do not recursively scan ordinary source files and call old files failed backup jobs.

2. Collect artifact metadata read-only

   Use Get-Item/Get-ChildItem only against the known backup-artifact path to collect name, full path, length, creation/last-write time, and read-access errors.

3. Classify freshness against the documented schedule

   Calculate artifact age and classify Fresh/Stale/Missing/Unknown using a configurable threshold. Preserve the observed timestamp and threshold in the report so the conclusion is reproducible.

4. Reconcile with authoritative job history

   Where the backup platform exposes job status, compare artifact freshness with the actual job record. A fresh artifact with a failed job or a successful job without the expected artifact must remain an exception.

5. Prove one restore or validation path

   Use a disposable artifact or existing recovery drill to show that freshness alone is not recoverability. Link the result to the Backup Restore Drill workflow rather than claiming this report proves restore success.

Validation

• The report scans only documented backup artifact locations

• Stale classification is based on a stated schedule/threshold

• Missing/unreadable evidence is reported as UNKNOWN/FAIL rather than silently omitted

• No source-file timestamp is described as backup-job status

• At least one artifact is cross-checked with the backup platform or restore-validation evidence

Troubleshooting

• If no artifact is found, confirm the configured destination and job design before changing thresholds

• If timestamps are misleading because of copy/replication semantics, use the backup product's authoritative metadata instead

• If the real requirement is backup-job monitoring rather than artifact freshness, use the backup platform API/logs and rename the workflow accordingly

Cleanup or Rollback

• Remove only disposable test artifacts created for validation

• Retain the CSV/report and link to the authoritative backup job or restore evidence

Next Improvements

• Review the audit log regularly.

• Modify the script to include email notifications for stale jobs.

• Consider implementing automated cleanup of stale jobs.