Preservation
What backup software is for
Copying files is easy. Any tool does it. What sets photo backup software apart is two harder things: proving that the copies are intact, and giving the files back the day you need them, without damaging anything on the way.
For a photographer, the stakes are specific. An original does not change: a RAW file from 2009 must stay, byte for byte, the one from 2009. Any difference is an alteration. Good software has to detect it, date it, and tell you what to do.
This article does not go back over the 3-2-1 rule or the choice between a NAS and object storage. It is about the software itself: the questions to ask it before you trust it with your originals.
The criteria, one by one
1. Real integrity checks
Checking means re-reading each file in full and comparing its fingerprint (SHA-256, for example) with the one taken when it was backed up. Seeing that a file exists, or that it has the right size, proves nothing: a corrupted file often keeps its size and its name.
Ask this too: what does the software say about a file it could not read, on a disconnected drive for instance? If it counts it as “verified”, it hides exactly the situation in which files are lost without anyone knowing. The method is covered in checking the integrity of a photo archive.
2. Scheduled checks that do not go quiet
A check done once does not protect the years that follow. The software should rerun checks at regular intervals. Above all, a check that was stopped or failed must not count as done. Otherwise a fault buys you a month of silence.
3. A restore that overwrites nothing
Restoring is the riskiest moment: it often happens in a hurry, on a drive that still holds files. Three requirements:
- the archive is verified before anything is written;
- files are restored into a new folder, or next to existing files, never on top of them;
- each restored file is re-read and compared with its original fingerprint.
A backup you have never restored is still an assumption. See testing a restore.
4. Several copies, on several media, one of them offsite
The software should know where your copies are, not just make one. Three new drives on the same desk count as one copy as far as risk goes: a fire or a burglary takes them all.
For the offsite copy, look at two things. First, the possible destinations: online storage, a NAS, a drive kept somewhere else. Then, how the remote copy is checked. A “successful” upload says the transfer finished, not that the copy is readable today.
5. Formats readable without the software
Ask yourself: if the publisher disappears, how do I get my files back? The right answer is an open format (tar, zip) and an inventory you can read in a text editor, with each file’s fingerprint. A closed format ties your archives to the life of one product.
6. A journal you can read back
Preserving also means being able to say what was done, and when: which archive was created, verified, sent, restored. That journal should grow without ever being rewritten. It is what tells you from when a file stopped matching.
7. Alerts about storage media
An integrity check finds corruption after the fact. A drive’s age announces the next one. Good software keeps an inventory of your media, their commissioning dates, and warns you before their replacement deadline.
8. Your files are not held hostage
What happens if you stop paying, or move to a new Mac? Verifying and restoring your own copies should remain possible in every case.
At a glance
| Criterion | Question to ask | Warning sign |
|---|---|---|
| Integrity | Does it re-read each file in full? | “Verified” without a full read |
| Scheduled checks | Does a stopped check count? | Deadline pushed back despite a failure |
| Restore | Can it overwrite an existing file? | Restoring “on top” by default |
| Copies | Does it know where my copies are? | Only one possible destination |
| Offsite | Does it verify the remote copy? | Only the upload is checked |
| Format | Readable without it? | Undocumented proprietary format |
| Journal | Dated, unalterable history? | No history, or an erasable one |
| Media | Replacement deadlines? | No tracking of drives |
| Dependence | Restore without a subscription? | Restore reserved for subscribers |
Common traps
- Mistaking sync for backup. A sync service also copies deletions and corruption. It is a means of transport, not an archive.
- Encrypting without keeping the key. An encrypted archive whose key is lost is lost. Export the key and store it separately, in two places.
- Orphaned incremental backups. A revision that holds only changed files can be restored only with its whole chain. If one revision is missing, the project comes back incomplete.
- Believing the final message. “Backup complete” means the copy stopped. Not that it was read back.
How Obscura Vault meets these criteria
Integrity. Vault imports a folder by computing the SHA-256 fingerprint of each file. A fixity audit then re-reads every file in full and compares its fingerprint with the one from the import. Each file is in one of four states: Verified, Altered, Unverifiable, or Never Checked. A missing file is never counted as verified.
Scheduled checks. The automatic audit can run every week or every month. A stopped or failed audit leaves the audit due. An incomplete audit is retried the next day. One limit to know: the scheduled audit only runs while Vault is open.
Restore. Vault verifies the archive before extracting and refuses one that fails. It restores into a new subfolder, never overwriting a file already there, then re-reads each file and compares it with the manifest. An incremental revision is never restored alone: Vault rebuilds its whole chain, or refuses.
Copies. The Storage Media screen turns the 3-2-1 rule into three tiers: working, local archive, offsite. It flags a tier with no active medium. Offsite copies go to S3 or compatible storage (Amazon S3, Backblaze B2, Cloudflare R2…), to a remote folder such as a NAS, or to the local folder of Google Drive, Dropbox, OneDrive, or iCloud Drive. To verify an offsite copy, Vault downloads its content and recomputes its fingerprint. For a synced folder, it tells apart a copy written on the Mac from one the service reports as uploaded.
Format. An .obf archive is a folder: tar, tar.gz, zip, or zstd content, a readable JSON manifest, and a signature. An unencrypted archive can be used without Vault, with the Mac’s standard tools.
Journal. The journal records every action, and each project has its own preservation journal. Both are append-only. Each line carries the fingerprint of the previous one, so an altered line shows up.
Media. Each medium gets a replacement deadline. It turns to Replace Soon three months ahead, and the Dashboard shows it.
Keys. The Keys and security chapter explains how to export keys and why to keep two copies, in two places.
Dependence. Everything that gets your data back stays available without a licence: verifying, restoring, downloading an offsite copy.
Vault does not describe your images: no keywords, no captions. It takes care of keeping them.
Going further
Before you choose, run each candidate through the table above. If you want your originals verified, copied offsite, and restorable without any risk of overwriting, Obscura Vault was built for that. Its guides, and those of the other applications in the suite, are gathered in the documentation, and all four are presented on the software page.