Field Notes · 5 November 2025

Running a recovery drill without burning the afternoon

Short drills fail because tools are missing. Longer drills fail because nobody owns the clock. Observation notes from Hong Kong rooms.

Recovery drills shrink when someone assumes the test device, cable, and notepad are already in the room. They expand endlessly when nobody calls time on a stuck passphrase step.

What we see as observers

  • Missing USB cables for older models
  • Test wallets that still hold residual practice seeds from last year
  • Two people who both think the other holds the spare passphrase knowledge
  • No blank line on the fleet list for “recovery proof date”

A compact drill shape

  1. Confirm the shortlist of devices (three is enough for a quarterly drill).
  2. Lay out cables and a disposable test unit before the clock starts.
  3. Run recovery to a known test address only.
  4. Write the date beside each serial on the rotation checklist.
  5. Stop at ninety minutes unless a safety issue demands otherwise.

If the drill cannot finish in that window, the unfinished devices stay unmarked — which is itself a finding for the next fleet review.