I have between 20-30 TB of data I want to keep a copy of in a firesafe. I do not want to use an online storage solution, I want to maintain my personal data at my home.
My current plan is to get (2) Mediasonic HFR2-SU3S2 PRORAID enclosures and (8) WD Red Pro NAS 16TB drives to fill them. The first would contain a full backup and be placed in the safe. The second would be attached to my machine and receive nightly backups. Periodically, I would rotate the enclosures, taking the one from the safe and swap it with the one connected to my machine.
Are there any problems with my plan that I am not thinking of? Are there better solutions?
Is anyone else keeping a rotating data backup in a safe? How is it working out for you?
Sounds fine?
Yes: Treat the two enclosures independently and symmetrically, such that you can fully restore from either one (the only difference would be that the one in the safe is slightly stale) and the ongoing upkeep is just:
- Think: “Oh, it’s been awhile since I did a swap” (or use a calendar or something)
- Unplug the drive at the computer.
- Cary it to the safe.
- Open the safe.
- Take the drive in the safe out.
- Put the other drive in the safe.
- Close the safe.
- Cary the other drive to the computer.
- Plug it in.
- (Maybe: authenticate for the drive encryption if you use normal full-disk encryption & don’t cache the credential)
If I assume a normal incremental backup setup, both enclosures would have a full backup and a pile of incremental backups. For example, if swapped every three days:
Enclosure A Enclosure B ----------------- --------------- a-full-2023-07-01 a-incr-2023-07-02 a-incr-2023-07-03 b-full-2023-07-04 b-incr-2023-07-05 b-incr-2023-07-06 a-incr-2023-07-07 a-incr-2023-07-08 a-incr-2023-07-09 b-incr-2023-07-10 b-incr-2023-07-11 b-incr-2023-07-12 a-incr-2023-07-13 ....
The thing taking the backups need not even detect or care which enclosure is plugged in – it just uses the last incremental on that enclosure to determine what’s changed & needs to be included in the next incremental.
Nothing need care about the number or identity of enclosures: You could add a third if, for example, you found an offsite location you trust. Or when one of them eventually fails, you’d just start using a new one & everything would Just Work. Or, if you want to discard history (eg: to get back the storage space used by deleted files), you could just wipe one of them & let it automatically make a new full backup.
Are you asking for help with software? This could be as simple as dar and a shell script.
My personal preference is to tell the enclosure to not try any fancy RAID stuff & just present all the drives directly to the host, and then let the host do the RAID stuff (with lvm or zfs or whatever), but I understand opinions differ. I like knowing I can always use any other enclosure or just plug the drives in directly if/when the enclosure dies.
I notice you didn’t mention encryption, maybe because that’s obvious these days? There’s an interesting choice here, though: You can do normal full-disk encryption, or you could encrypt the archives individually. Dar actually has an interesting feature here I haven’t seen in any other backup tool: If you keep a small
--aux
file with the metadata needed for determining what will need to go in the next incremental, dar can encrypt the backup archives asymmetrically to a GPG key. This allows you to separate the capability of writing backups and the capability of reading backups. This is neat, but mostly unimportant because the backup is mostly just a copy of what’s on the host. It comes into play only when accessing historical files that have been deleted on the host but are still recoverable from point-in-time restore from the incremental archives – this becomes possible only with the private key, which is not used or needed by any of the backup automation, and so is not kept on the host. (You could also, of course, do both full-disk encryption and per-archive encryption if you want the neat separate-credential for deleted files trick and also don’t want to leak metadata about when backups happen and how large the incremental archives are / how much changed.) (If you don’t full-disk-encrypt the enclosure & rely only on the per-archive encryption, you’d want to keep the small --aux files on the host, not on the enclosure. The automation would need to keep one --aux file per enclosure, & for this narrow case, it would need to identify the enclosures to make sure it uses that enclosure’s --aux file when generating the incremental archive.)Thank you so much for all the information! I actually simply use rsync to synchronize all my data to whichever backup drive is connected. Are there benefits to using dar instead of rsync? I haven’t used dar before. I also haven’t dabbled in encrypting my backup… My concern with that would be the additional time it takes to encrypt everything, as well as my fear of losing the ability to decrypt it. I am mostly putting this out there to see if anyone has suggestions for different media I hadn’t thought of, or if anyone sees any pitfalls in my plan I hadn’t thought of. I’m planning on storing the enclosure in a phoenix datacare 2001 fireproof safe. It’s supposed to be able to keep hard drives, CDs, tapes, etc. safe in a fire for over an hour.
The benefit of using something fancier than rsync is that you get a point-in-time recovery capability.
For example, if you switch the enclosures weekly, rsync gives you two recovery options: restore to yesterday’s state (from the enclosure not in the safe) and restore to a state from 2-7 days ago (from the one in the safe, depending on when it went into the safe).
Daily incremental backups with a fancy tool like dar let you restore to any previous state. Instead of two options, you have hundreds of options, one for each day. This is useful when you mess up something in the archive (eg: accidentally delete or overwrite it) and don’t notice right away: It appeared, was ok for awhile, then it was bad/gone and that bad/gone state was backed up. It’s nice to be able to jump back in time to the brief it-was-ok state & pluck the content back out.
If you have other protections against accidental overwrite (like you only back up git repos that already capture the full history, and you
git fsck
them regularly) — then the fancier tools don’t provide much benefit.I just assumed that you’d want this capability because many folks do and it’s fairly easy to get with modern tools, but if rsync is working for you, no need to change.
Thank you, it sounds great, I will look more into dar.
Thanks for pointing out dar, out definitely has some very interesting capabilities. My backup took off choice is BorgBackup as it makes local/remote, encrypted, deduplicated backups easy and allows for mounting previous snapshots via fuse fs for easy restore.
I don’t see a problem with your plan, except I would keep a copy offsite as per the 3-2-1 backup advice. If you don’t feel comfortable with the cloud, maybe a safe deposit box.
You’ll need to get a fire rated media safe, not just a fireproof safe. A regular fireproof safe will keep the internal temperature below 175C if exposed to a 30 minute wood fire - what you’d typically experience in a home fire. The 175C is to stop paper from igniting, but at that temp your HDDs would be toast.
A data/media safe should maintain an internal temp of under 60C if exposed to the same fire. That means it needs to have much more thermal insulation, and as a consequence it will be significantly bigger and more expensive. To fit in the whole enclosure, you’ll probably have to pay more for the safe than the HDDs.
I’m thinking of going with the Phoenix DataCare 2001 which is indeed a fireproof media safe specifically for keeping hard drives, discs, etc. safe in a fire for over an hour. I hope I never need to test it, but of all the non-living things in our home we couldn’t replace, it’s our personal pictures, video, and business related data. Western Digital is having a sale on their drives today and I picked up (8) 16TB WD Pro Red NAS drives for $219 each. WD Red Pro (normally $289.99)
Instead of a fire safe which will only offer some protection I would rather get two Pelican style cases. Keep your backup drive(s) in there. Use a deduplicating/encrypted backup software to create two backup sets (I highly recommend BorgBackup). Store one of the backup cases off-site (at a friend’s house, in a drawer at work, …) and occasionally rotate the two cases.
For my 1 part of the 3-2-1 plan, I have an encrypted copy at my work, and I also ship an encrypted copy to a trusted friend.
My work copy I can always get in a few minutes, my friend is if something big happens locally.
I have 4 cold storage disk, 2 are rotated about every month. And the one that’s with my friend is rotated once a year.
Something else to think about, safes can get a little humid on the inside. Having something to collect moisture would be a great idea. Don’t need rust on your spinning rust.
Thank you for the reminder, I’ll add some dessicant packs