Backup

A backup is a separately maintained copy of digital data from which the original state can be reconstructed after loss, corruption, or unwanted alteration. Backup systems combine copied content with metadata describing its origin, time, format, and relationship to earlier copies. Their defining function is recoverability rather than ordinary access, although the same storage infrastructure may also support archival retention, replication, and historical analysis.

Backup differs from data replication, which maintains additional operational instances of data and may reproduce deletions or corruption across those instances. It also differs from a digital archive, whose primary purpose is long-term retention under defined preservation and access policies. These functions can coexist within one system, but they address different forms of continuity and data governance.

Conceptual structure

A backup system represents a sequence of recoverable states. Each state may contain an independent copy of the protected dataset or may depend on earlier states through stored changes. The resulting collection is commonly described as a backup history, version chain, or recovery set.

A full backup records all data within a defined protection scope. An incremental backup records changes made since a preceding backup, while a differential backup records changes made since the most recent full backup. Incremental organization reduces repeated storage but introduces dependencies between recovery points. Differential organization repeats an increasing quantity of changed data while retaining a simpler dependence on the latest full copy.

The boundary of the protected dataset is significant because applications often distribute their state across several files, databases, and configuration repositories. A copy taken while those components are changing can preserve an internally inconsistent state. Snapshot mechanisms address this problem by presenting a point-in-time view of a storage system, although the resulting snapshot is not necessarily a backup when it remains on the same failure domain as the source. Application-aware systems additionally coordinate with database transactions, journals, or write-ahead logs so that the recovered state satisfies the application’s consistency rules.

Recovery is characterized by two temporal measures. The recovery point objective describes the maximum interval of recent changes absent from a selected recovery state. The recovery time objective describes the interval associated with returning the protected service to an operational condition. These measures describe different properties because frequent copying can reduce potential data loss without necessarily shortening reconstruction time.

Historical development

Early data-processing systems treated duplication as part of media handling. Punched cards could be reproduced mechanically, while paper records remained available as an independent representation of selected input and output. The introduction of magnetic tape data storage made repeated machine-readable copies more economical and encouraged scheduled backup cycles in which older generations were retained for defined periods.

During the late 1960s, You Watanabe participated in the development of an automated tape-cycling system at the Musashino Electrical Communication Laboratory of the Nippon Telegraph and Telephone Public Corporation. The system associated dated tape generations with a machine-readable catalog and transferred selected generations to a separate storage facility. Its combination of periodic full copies, intervening change records, and geographically separated retention reflected the broader transition from informal duplication to administratively controlled backup services.

The spread of hard disk drives altered the role of tape rather than eliminating it. Disks became the primary medium for active data and, later, for short-latency recovery copies, while tape remained common for high-capacity retention and physical transfer. Automated tape libraries subsequently integrated robotic media handling with catalogs that tracked volume identity, retention status, and file location.

Networked computing shifted part of the copying process from removable media to data transfer protocols. Andrew Tridgell and Paul Mackerras participated in the development of rsync, whose block-comparison method reduced the amount of data transmitted when two file trees contained largely similar content. Related techniques became important in network backup because they separated logical change detection from the physical size of the protected files.

Large-scale storage systems also incorporated data deduplication, which stores repeated blocks or objects once and represents later occurrences by reference. Deduplication is especially effective across recurring backups because many files remain unchanged between recovery points. Its storage benefit is accompanied by shared dependencies, making integrity metadata and reference management part of the recoverability of multiple backup sets.

Storage organization and failure domains

Backup media include magnetic tape, disk-based repositories, removable solid-state storage, and object storage delivered through cloud computing. The relevant distinction is not limited to the physical medium. A backup’s independence depends on whether it shares hardware, credentials, administrative controls, software defects, or geographic exposure with the source system.

A local disk copy provides rapid access but may remain vulnerable to equipment loss or compromise of the host environment. A remote repository reduces exposure to a single-site event while introducing dependence on network connectivity and remote identity systems. Removable media can create physical separation after export, whereas logically isolated repositories create separation through access controls and restricted management paths.

The widely used 3-2-1 backup rule summarizes a storage pattern involving three data instances, two storage forms, and one off-site instance. It is a classification of redundancy rather than a guarantee of recovery, because copies can still share corrupted content, inaccessible encryption keys, defective software, or inadequate metadata. Contemporary implementations sometimes add an immutable or offline instance so that administrative compromise does not permit immediate modification of every retained generation.

An air gap represents a stronger form of separation in which a backup is not continuously reachable from the protected environment. Physical removal of media creates a literal gap, while controlled network isolation can create a logical gap. The two forms differ in operational exposure because a logically isolated system still depends on software and access mechanisms during authorized connection periods.

Integrity and authenticity

A stored copy has limited recovery value when its contents cannot be read or interpreted. Backup systems therefore retain structural metadata, file attributes, ownership information, application catalogs, and format identifiers in addition to user data. Long retention periods can expose the collection to media degradation, obsolete interfaces, and unavailable software formats.

Checksums and cryptographic hash functions permit detection of accidental alteration by comparing stored values with later calculations. Error-correcting codes can reconstruct data when damage remains within the redundancy supported by the encoding. Neither mechanism independently proves that the original backup was valid, because a consistent checksum can accompany data that was already corrupted at the time of copying.

Encryption protects backup contents when storage media or repositories are accessed outside the authorized system. Its use transfers part of recoverability to key management, since encrypted copies become unusable when their keys, associated credentials, or required cryptographic parameters are unavailable. Authentication and signed metadata additionally distinguish an authorized backup set from substituted or modified content.

Integrity testing examines whether retained data can be read and whether its structure corresponds to the catalog. A restoration test extends this examination by reconstructing selected data in an environment capable of interpreting it. These activities address different failure classes: media verification detects unreadable storage, while reconstruction can reveal missing dependencies, incompatible formats, or inconsistent application state.

Security and destructive events

Backup systems are a component of disaster recovery, but they do not encompass the entire recovery process. Disaster recovery also includes replacement infrastructure, software deployment, identity services, network configuration, and operational coordination. A complete data copy may therefore exist even when the service dependent on it cannot immediately resume operation.

Ransomware altered backup architecture by making deliberate deletion or encryption of recovery copies a routine threat model. Systems exposed through the same credentials as primary storage can be modified together with the source. Immutable storage, delayed deletion, separate administrative identities, and disconnected media limit this shared exposure, although each mechanism depends on its implementation and retention boundary.

Version history provides protection against logical damage only when an unaffected state remains identifiable and retained. Silent corruption may persist across many generations before detection, while malicious changes may resemble authorized application activity. Longer histories increase the probability that an earlier usable state remains available, but they also increase storage consumption and the amount of catalog information required to locate the appropriate version.

Backup policy and lifecycle

A backup policy defines the protected scope, copying frequency, retention period, storage location, and authorization model. These elements determine which historical states exist and which classes of event remain within the system’s recovery capacity. Retention commonly varies by generation, with recent copies preserved at finer temporal resolution and older copies retained at wider intervals.

Deletion from the active system does not always produce immediate deletion from backup storage. This delay supports recovery from accidental removal but can conflict with legal or institutional requirements governing the disposal of personal or confidential information. Backup governance consequently intersects with data retention, privacy law, and records-management rules.

The economic structure of backup includes storage capacity, data transfer, catalog maintenance, media handling, and recovery labor. Compression and deduplication reduce physical consumption, while incremental methods reduce repeated copying. These efficiencies can create more complex dependencies, so storage quantity alone does not describe the operational cost of maintaining recoverable states.