Let’s take an example. It is made up, but many photographers will recognise themselves in it.
Claire has been photographing weddings for fifteen years. She is careful. Her RAW files live on her Mac’s working drive. Every night, an automatic backup copies them to an external drive. Once a month, she clones that drive onto a second one, which she keeps at her sister’s. Three copies, two kinds of media, one away from home: the “3-2-1” rule that most guides recommend.
One day, a client asks for the pictures of her wedding, five years earlier, for an anniversary album. Claire finds the folder easily. But when she opens it, several files show a grey band. She fetches the backup drive: same files, same flaw. The drive at her sister’s: the same. Her three copies are three copies of the same damaged file.
Claire did nothing wrong. She backed up. What she was missing was something else.
Backing up is not preserving
A backup answers one question: if I lose this drive, do I have another copy? That is essential, and the 3-2-1 rule answers it well.
But it does not answer another question: is that copy still identical to the original? A backup copies whatever it finds. If the source file has silently changed, the next backup faithfully copies the change. Over time, and as drives are rotated, the last healthy version can disappear without anyone noticing.
The previous article in this series explained why a digital file, which does not wear out, can still change: aging media, interrupted copies, syncs that write over good files. Multiplying copies protects you against losing a medium. Only checking protects you against alteration.
Four words that are often confused
These four words are often used interchangeably. Yet they mean different things, and each one adds something to the one before.
A copy. A file duplicated somewhere else. Nothing more: you don’t know whether it is complete, or whether it will stay that way.
A backup. A copy made so it can be recovered after a loss, usually automatically and regularly. It follows the current state of your files, which is its strength (it is up to date) and its weakness (it follows mistakes too). Many backup tools keep only a limited number of older versions.
Archiving. Setting a body of files aside, frozen, to keep it for a long time: the finished assignment, the closed collection, the delivered commission. An archive no longer follows changes; it is meant to keep the state of one moment.
Preservation. Archiving, plus ongoing proof that what is kept is still intact and still recoverable. In practice, preservation adds:
- integrity checking: a fingerprint of each file, taken at the start, against which the present state is compared;
- traceability: a dated history of what was checked, when, and with what result;
- periodic checks: you don’t check once, you check regularly, on every copy;
- tested restoration: you know how to put the files back, and you check that they came back intact.
The difference fits in one sentence: a backup says “I have a copy”; preservation says “I have a copy, and I know it is good”.
What Claire could have known
With fixity checks, Claire’s story changes on one decisive point: she would have known in time. An audit would have read her files again, recomputed their fingerprints, and flagged the ones that had changed, perhaps years before her client’s request. At that point a healthy version still existed somewhere: on an old drive, in an older archive. The problem would have been a restore, not a loss.
That is what is at stake: an alteration found early can be repaired; an alteration found late can only be recorded.
How Obscura Vault approaches preservation
Obscura Vault does not replace your backup software. It adds what backup lacks: proof that the copies are good, and a way to put a healthy copy back.
Archives that can be verified
An .obf archive is a package holding the whole folder of a project, compressed, optionally encrypted, with its inventory (the manifest) and a signature. The manifest lists every file, with its path, size and SHA-256 fingerprint. The signature guarantees that the manifest has not been modified since the archive was created.
Vault reads each archive back as soon as it is written: it is only reported as “created and verified” if its signature and the fingerprint of its content match. You can verify it again at any time, including an archive kept on an external drive. The format is described on The .obf format page and in the Create, verify and restore an archive chapter of the user guide.
Copies that really count
Vault follows the 3-2-1 rule with three tiers of storage media: N1 (working), N2 (local archive), N3 (offsite). Every drive, tape or online space you declare gets a replacement due date: a rough figure based on its kind, not a manufacturer’s guarantee, but a date, because a medium with no due date never gets replaced. When a tier has no active medium, Vault says that the 3-2-1 rule is not being met. Three new drives sitting in the same place make only one copy.
An offsite copy that is verified, not just sent
The Offsite screen sends your archives to S3-compatible storage (Amazon S3, Backblaze B2, Cloudflare R2, MinIO…) or to a remote folder (a NAS, a network drive).
Two rules protect these copies:
- before sending, Vault verifies the local archive. A damaged archive is never sent, and the copy already at the destination stays intact. That is exactly what Claire was missing: on the day the Mac’s drive starts to fail, the offsite copy is not overwritten with a damaged version;
- after sending, the copy is verified before the upload is reported as successful. A wrong copy makes the upload fail: a wrong copy is worse than no copy.
An offsite copy can also be verified later: Vault reads its content back and compares it with the signed manifest. A copy the service refuses to read is “unverifiable”, never “damaged”. The details are in the Offsite copies chapter.
Periodic checks, and a history
Fixity audits read your files again every week or every month, and each check is added to a log that is never rewritten. Each archive verification is also recorded with its date. The Dashboard sums it all up: it only shows Everything Is Verified if every file has been read and is intact, no archive has failed, and your copies actually exist (an active medium at each tier, an archive offsite, archive keys exported, a complete audit that is not overdue, among others). Otherwise it says what is missing.
And, as with files, Vault always keeps Verified, Altered, Unverifiable and Never Checked apart. Verifying an archive kept on a disconnected drive gives “unverifiable”, never “verified”: a missing drive proves nothing. See Fixity checks.
A restore that checks itself
Restoring is the moment preservation pays off. Vault:
- verifies the archive before extracting anything: an archive that fails verification is refused;
- extracts the files into a new folder, never overwriting a file that is already there;
- reads every restored file back and compares its fingerprint with the manifest, then tells you whether everything matches or which files differ.
Restoring is free, from a local archive as from an offsite copy. The user guide recommends doing one from time to time, into a separate folder: it is the only way to know you have everything you need, keys included, on the day you need it.
What to remember
- Three copies protect you against losing a medium, not against a file being altered, which backups copy faithfully.
- Copy, backup, archiving and preservation are four different steps. Preservation adds integrity checking, traceability, periodic checks and tested restoration.
- A copy is only worth something if you know it is good: every copy must be verifiable, and actually verified.
- An unverified copy is neither good nor bad: it is unknown.
That leaves a question most backup strategies never ask: in twenty years, which software will open these archives? That is the subject of the next article.
Next in the series: In 20 years, will anyone still be able to open your photo archives?
Previous article: A digital file doesn’t wear out. So why check its integrity?