How long do you keep your backups

Backup retention periods seem to be driven by urban myths and how systems worked in the 1970s. Not wholly surprising since most back up software still seems to be stuck in that period and most sales pitches are urban myths.

So how long do you keep backups for (this is the easy starter question) 10 years, 7 years or even forever? Do you keep you daily backups for that long or only your monthly or yearly ones?

Why (don’t you just hate it when someone says why) have you chosen that time period? Was it because someone in the business said there was a law that said they had to keep some data for that time?

What happens to stuff that was created and then deleted between your backups tapes?

Have they ever shown you the law that states that?

My first question is where is the data kept?

Most HR/finance/legal systems likely to have a data retention requirement store data in a database these days and the data covers the last seven years or whatever is the legal requirement or for whatever period the department wants to keep it. So, if you restore the database from last night’s backup there would be seven years of data yes? So why do you have seven years of backups? If you restored the database from 7 years ago it would contain data that was 7-14 years old, is that any use to anyone? Is it even legal to keep data about someone for that long? (GDPR brings with it the right to be forgotten).

Back in the day when most databases were flat file types or even just spreadsheets and documents and storage cost a lot, the only other copy of the data was on the backup tape and it all made sense. However, most modern systems retain the required data in the system for the required period of time, it is probably one of the reasons that system was bought in the first place.

You may have some file shares that have data covered by some vague 7-year rule (Health and Safety springs to mind) but if there is a legal requirement there should be a system to manage it and it should also manage versioning of documents, logging changes and by whom, a file share may not be up to the job, legally.

The question now is, how long should you keep backups and why should you keep them at all?

Stuff gets deleted, for sure, and there is always that threat of encryption malware so you need to be able restore it and you need copies somewhere else. That is the case for backups made, now how long to keep them and what frequency do you take them?

We keep daily backups for 3 months and that is it, as for frequency it depends on the system and server function, where’s the data, how often does it change and what is your ability to re do and missing data? A web front server has nothing of interest on it so a weekly backup will suffice for most, a database server may need TL backups every 15 minutes and a file server daily, but using inbuilt systems to give better protection such as VSS, not a backup strategy but a basic versioning system, SharePoint and other systems can do this better if needed.

The business took its sweet time to get it’s head around it like many things when you challenge an historic convention based on myths and outdated technology, but we are getting there. Cost for tapes and offsite storage where waved under noses to stimulate the thought processes. We still have some file stores that need some longer retention, but it is a very small amount of data it is not a real issue and should eventually be moved to a proper system. For email (always a sticky problem) we now have a cloud based journaling system in place, all email will always available which is better than we had before from periodic backups, we have failover email servers and backups for speedy system recovery not for email recovery (what was your email running on 10 years ago, could you recover an Exchange 2000 system to get that email back even if you could lay your hands on the Backup exec software and Windows 2000 install CD to go on an old server that can take the only functioning SDLT/LTO 2/AIT tape drive left).

Backups need to be brought in to the here and now and be designed to useful and manageable with today’s systems and quantity of data, not still trying to support system design from the 70s. Virtualization is a game changer for backups and you need to move away from one size fits all to one that looks at the data and protects accordingly.

Data, what is it, where is it, how often does it change and how would you regenerate it at the application level? These are the questions to ask, expect some blank stares in response.