See what metadata your backup tool sends
Restic shows what it backs up, in encrypted form
restic -r s3:backup-bucket/mybackup snapshots

But the snapshot metadata itself is encrypted
The provider only sees encrypted objects of various sizes

With Duplicati, you can verify encryption locally:
duplicati-cli test-filters --include-filter="" /local/backup/path

Apple's 2023 transparency report showed
60,000+ government account requests globally
~80% compliance rate in the US

Check a provider's transparency report
Most major providers publish these annually

Install restic
sudo apt install restic   # or brew install restic

Initialize a repository (the encryption passphrase is your key)
restic -r s3:s3.amazonaws.com/my-backup-bucket init
Enter a strong passphrase. store it in your password manager

First backup
restic -r s3:s3.amazonaws.com/my-backup-bucket \
  --password-file ~/.restic-password \
  backup ~/Documents ~/Pictures

Scheduled backup (cron)
echo "0 2 * * * restic -r s3:s3.amazonaws.com/my-backup-bucket --password-file ~/.restic-password backup ~/Documents" | crontab -

Restore
restic -r s3:s3.amazonaws.com/my-backup-bucket \
  --password-file ~/.restic-password \
  restore latest --target /tmp/restore-test

Linux - install from cryptomator.org/downloads
Creates a vault directory. contents are encrypted before syncing

Structure on cloud:
Dropbox/my-vault/
  d/             (encrypted directory tree. names are random UUIDs)
  masterkey.cryptomator  (encrypted master key)
  vault.cryptomator      (config)

Attacker or Dropbox employee sees:
Random 36-char directories with encrypted filenames
Cannot determine file count, names, or structure

Install
sudo apt install borgbackup

Initialize encrypted repository (repokey = key stored in repo, encrypted by passphrase)
borg init --encryption=repokey-blake2 user@backup-server:/backup/mybackup

Backup
export BORG_PASSPHRASE='your-strong-passphrase'
borg create user@backup-server:/backup/mybackup::'{hostname}-{now}' \
  ~/Documents ~/Pictures

List backups
borg list user@backup-server:/backup/mybackup

Export the repo key (back this up separately. losing it = losing all backups)
borg key export user@backup-server:/backup/mybackup ~/borg-key-backup.txt

#!/bin/bash
backup-test.sh - Test backup recovery capability

BACKUP_LOCATION="s3:my-backup-bucket"
TEST_FILE="/tmp/backup-test-$(date +%s).txt"
TEST_DATA="Critical data - $(openssl rand -hex 32)"

echo "$TEST_DATA" > "$TEST_FILE"

Test 1 - Can you encrypt and back up?
echo "Testing backup encryption..."
restic -r "$BACKUP_LOCATION" --password-file ~/.restic-password \
  backup "$TEST_FILE"

if [ $? -ne 0 ]; then
    echo "ERROR: Backup failed"
    exit 1
fi

Test 2 - Can you restore?
RESTORE_DIR="/tmp/restore-test-$(date +%s)"
mkdir "$RESTORE_DIR"

echo "Testing restoration..."
restic -r "$BACKUP_LOCATION" --password-file ~/.restic-password \
  restore latest --target "$RESTORE_DIR"

if [ $? -ne 0 ]; then
    echo "ERROR: Restore failed"
    exit 1
fi

Test 3 - Is the data intact?
RESTORED_FILE=$(find "$RESTORE_DIR" -name "backup-test-*" | head -1)
RESTORED_DATA=$(cat "$RESTORED_FILE")

if [ "$TEST_DATA" == "$RESTORED_DATA" ]; then
    echo "SUCCESS: Backup and restore working correctly"
else
    echo "ERROR: Restored data does not match original"
    exit 1
fi

Cleanup
rm -rf "$RESTORE_DIR" "$TEST_FILE"

Restic with S3 backend
The passphrase NEVER leaves your machine
The provider sees only encrypted blobs

Attacker with S3 access sees:
- Encrypted data (useless without passphrase)
- Backup timestamps
- Approximate backup sizes
Cannot see - filenames, content, directory structure

Even if AWS is breached:
- Your encrypted backups remain secure
- Attacker cannot read any data without your passphrase
- AWS cryptographic keys are irrelevant to your data

Step 1 - Export from Google Drive
Use Google Takeout (takeout.google.com)
Downloads all data as encrypted backup file

Step 2 - Transfer to Restic
tar -xzf takeout.tar.gz
restic -r s3:my-secure-bucket \
  --password-file ~/.restic-password \
  backup ~/Downloads/Takeout/

Step 3 - Verify
restic -r s3:my-secure-bucket \
  --password-file ~/.restic-password \
  restore latest --target /tmp/verify-restore

Step 4 - Delete from cloud provider (optional)
Settings → Manage your Google Account → Data & Privacy → Delete...

Generate a strong passphrase using cryptography-grade randomness
openssl rand -base64 32
Output - aB3xY9kL2mN5oP8qR1sT4uV7wX0yZ

Or use diceware method (human-memorable, cryptographically strong)
Download diceware word list and roll dice
correct-horse-battery-staple
This is actually very strong (entropy comparable to random string)

Store securely:
1. Password manager (encrypted, backed up)
2. Physical safe (separate location from backups)
3. Never in plaintext on your computer

Test that you can remember or retrieve it
Losing the passphrase = losing all backups permanently