Recycle bins empty after 93 days. Permanently deleted email can be recovered for just 14 days by default. Ransomware doesn't wait for either. ECSG stacks four independent recovery layers, from a one-click file restore to a full server running as a virtual machine, so there is always a way back.
Each layer catches what the one above it can't.
The right recovery depends on what broke and how long ago it happened. Here is what each layer of our backup strategy is built to catch.
Someone deletes a folder, saves over the budget, or restores the wrong version. It happens every week in every company.
Layers 1 and 2A departing employee's account is removed, a Teams site is deleted, or a mass delete slips through unnoticed.
Layers 1 and 2Everything that lived only on the device (local files, applications, settings) disappears with it.
Layer 3Hardware fails or ransomware hits your on-site server, and the whole business waits.
Layer 4Microsoft 365 includes real recovery tools. They are useful, and they are short. Once a window closes, the data is gone unless another layer is holding it.
Bar lengths use a logarithmic scale. Windows for built-in tools apply to work and school accounts and depend on tenant settings. Retention policies can extend some of them, and we configure those too, but retention is not the same as being able to roll a whole site back after an attack. Layer 4 retention is policy-based and sized to your NAS.
Let's be honest: this layer is not a real backup. Recycle bins, version history and deleted-item recovery were built for everyday mistakes: the wrong folder deleted, the file saved over, the email tossed by accident. They fix a surprising number of Mondays and come included with Microsoft 365. They were never designed to stop a determined attacker or ransomware, and their windows close. That is what Layers 2 to 4 are for.
Best for everyday mistakes and the first minutes of an incident. Limit: the clock is always running.
A native backup service built into Microsoft 365 for SharePoint sites, OneDrive accounts and Exchange mailboxes. Backups live inside the Microsoft 365 data boundary, so restores don't have to crawl back across the Internet from a remote vault.
A full site or account restore rolls it back to that moment and overwrites later changes. That is why we choose restore points carefully and pair full restores with granular ones. Speeds are Microsoft's published medians and vary with item counts and site size.
OneDrive protects what is synced. Datto protects what the computer actually is: the files, the applications, the settings, the way it was set up. A lightweight agent on each endpoint sends encrypted backups straight to the Datto Cloud. No appliance, no VPN, and no need to be in the office.
*Backup frequency and retention depend on the Datto Endpoint Backup edition and plan, and follow Datto's published product specifications. We confirm the exact schedule for your environment during onboarding.
For businesses that won't settle for cloud-only backup, and for those that still run servers on site. We deploy and manage a Synology NAS with Active Backup for Business that backs up your servers and virtual machines every day, keeps versions, and when the worst happens, boots a copy of the failed server as a virtual machine on the NAS itself.
Running a virtual machine directly on the NAS requires a compatible Synology model sized for your workload. We size the hardware, storage and network during the assessment, and confirm feature availability for your DSM and Active Backup versions.
No single tool covers every scenario. Together, these four do.
| What went wrong | Layer 1Built-in M365 | Layer 2M365 Backup | Layer 3Datto Endpoint | Layer 4Synology NAS |
|---|---|---|---|---|
| A file is deleted or overwritten, and noticed within daysRecycle bin and version history (Layer 1) or granular restore (Layer 2) bring it back. Layers 3 and 4 help only if the file lived on the laptop or on the on-site server. | Yes | Yes | Partial | Partial |
| The same file is missed for 4 monthsRecycle bins close after 93 days. Microsoft 365 Backup keeps restore points for up to 2 years. Layers 3 and 4 depend on where the file lived and on their retention. | — | Yes | Partial | Partial |
| A SharePoint site or OneDrive account is deleted or damagedLayer 1 can bring back a deleted site or account, but cannot roll back one that was damaged. Layer 2 restores it to an earlier point in time. | Partial | Yes | — | — |
| An email is permanently deletedLayer 1 works only inside its window: 14 days by default, up to 30. After that, Layer 2 can still recover it. | Partial | Yes | — | — |
| Ransomware encrypts cloud filesLayer 1 can roll a library or OneDrive back up to 30 days, but it was not built for attacks. Layer 2 restores to a point before the attack, from backups the attacker cannot alter. | Partial | Yes | — | — |
| A laptop is lost, stolen or failsOnly Layer 3 rebuilds the whole device: applications, settings and local files. Layers 1 and 2 protect what was in the cloud, not the laptop itself. | — | — | Yes | — |
| Ransomware hits a single PCLayer 3 rolls the whole machine back to before the attack. If that PC syncs to OneDrive, encrypted files can travel to the cloud, so Layers 1 and 2 can help with those files only. | Partial | Partial | Yes | — |
| An on-site server failsLayer 4 boots the server as a virtual machine on the NAS. Datto can also back up Windows servers (Layer 3), but the NAS is the fastest way back for on-site servers. | — | — | Partial | Yes |
Yes means the layer is built for that scenario. Partial means it depends on how old the loss is, where the data lived (Microsoft 365, the device or the on-site server), or how far an attack spread. A dash means the layer is not designed for it.
We size the layers to how much data and how much downtime your business can afford, and then we prove they work.
We map where your data lives (Microsoft 365, laptops, on-site servers) and what a day without each of them would cost.
We match layers to your recovery goals: how far back you need to go, and how fast you need to be running again.
We configure retention, roll out the agents, install the NAS if you need one, and watch every backup job for failures.
We run restore tests on a schedule and document the results, so recovery day is a procedure and not a surprise.
Microsoft keeps the service running and includes recovery tools, but those tools have limited windows, as shown above. Protecting your content from accidental deletion, malicious changes and ransomware is a shared responsibility. That is exactly what Layers 1 through 3 are for.
Not always. Most businesses start with Layers 1 to 3 to protect Microsoft 365 and their endpoints. Layer 4 is for companies with on-site servers or that want a local copy they control. We size the plan to your recovery goals during the assessment.
Yes, at every layer. Microsoft 365 Backup can restore SharePoint and OneDrive content to a new URL and mailbox items to a new folder. Datto restores files to another device, or a whole system to new hardware. Synology restores virtual machines to a different host, or boots them on the NAS.
It depends on what broke. A single file is a matter of minutes. Per Microsoft's published figures, a full SharePoint site under about 1 TB can return in under 20 minutes with an express restore point. A failed on-site server can be running as a virtual machine on the NAS within hours while the replacement is prepared.
That is why the layers are separate. Microsoft 365 Backup uses append-only storage, Datto stores backups in its own cloud, and the Synology runs on isolated credentials with immutable snapshots and an offsite copy. Compromising one layer does not compromise the others.
Book a Backup and Recovery Assessment. We will map your data, show you where your recovery windows run out, and design the layers you actually need, in plain language and without the jargon.
Secure. Reliable. Human. We stay with you from the first backup to the day you need it.
Get a Backup Assessment Book a Call