---
title: "Take a backup and restore it before the · Agent Wranglers"
url: https://agentwranglers.se/playbook/codebase-takeover/triage/restore-before-first-change
id: TKO-3
level: Required
risk: data
updated: 2026-10-22
tokens: 656
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Take a backup and restore it before the first change

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: TKO-3
- Level: Required
- Chapter: [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md)
- Rule: Before the first change to inherited code or data, take a full backup of every data store and restore it on a separate machine.
- Check: A restore of a backup taken after the handover date runs on a machine outside production. The row counts of the five largest tables match production within the hours since the backup.
- Risk: Data leaked or lost
- How: The first change to unknown code is the one most likely to delete data. A backup set up by someone else may be empty, years old or encrypted with a key nobody has. Back up every store from the system map, including file storage and the builder's database. Restore one, then follow [Prove restores work](https://agentwranglers.se/playbook/data/backups-and-recovery/restore-tests.md) and [Back up off the machine](https://agentwranglers.se/playbook/operations/disaster-recovery/off-site-backups.md) from then on.

## Sources

- [CISA #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)

## Related rules

- DAT-28 [Prove restores work](https://agentwranglers.se/playbook/data/backups-and-recovery/restore-tests.md) in Data and databases
- OPS-45 [Back up off the machine](https://agentwranglers.se/playbook/operations/disaster-recovery/off-site-backups.md) in Operations and observability
- TKO-7 [Fix in risk order](https://agentwranglers.se/playbook/codebase-takeover/triage/fix-in-risk-order.md) in Codebase takeover

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/codebase-takeover/triage/restore-before-first-change">Agent Wranglers codebase takeover playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Rotate every secret the previous team could read](https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets.md)
- Next: [Run it from a clean checkout](https://agentwranglers.se/playbook/codebase-takeover/triage/run-from-clean-checkout.md)
- [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md)