# MikroDash isolated lab recovery

1. Confirm an isolated lab target and block router API connectivity.
2. Restore the checksummed `/data` archive with restrictive ownership.
3. Retrieve the matching encryption key from the approved vault; app data alone may not decrypt router credentials.
4. Start the pinned image with router access blocked; validate login and test device records.
5. Reconnect only the test router using the restricted account and verify the read-only boundary.