Offsite backup has meant tape rotation for decades: cartridges written overnight, collected by a courier and stored in a vault, with older sets brought back for reuse. The method is sound and many organizations still rely on it. It also depends on manual steps that are easy to miss, on media that must be handled correctly and on a retrieval process that takes hours or days. Disk and object storage now make it possible to keep an offsite copy with none of the physical handling.
This post looks at what tape rotation provides, which of those properties an offsite copy really needs and how to get them without moving media.
Rotation gives an organization three things. The first is distance: a copy in another location that survives the loss of the main site. The second is an air gap, since a cartridge on a shelf cannot be reached over the network. The third is a retention scheme, often grandfather-father-son, in which daily, weekly and monthly sets are kept for increasing periods. Any replacement has to deliver the same three properties, or the organization has to decide knowingly to give one up.
| Property | Tape rotation | Replicated copy at a second site | Cloud object storage copy |
|---|---|---|---|
| Distance from primary | Yes, vault location | Yes, second site or colocation | Yes, provider region |
| Protection from network attack | Physical air gap | Immutability enforced by storage | Immutability enforced by storage |
| How current the copy is | As of the last courier run | Minutes to hours behind | Minutes to hours behind |
| Time to start a restore | Hours to days for retrieval | Immediate | Immediate, or hours on archive tiers |
| Manual steps | Load, eject, label, hand over, track | None in normal operation | None in normal operation |
| Ongoing cost drivers | Media, drives, courier, vault fees | Hardware, space, network link | Capacity, requests, egress on restore |
Tape itself is reliable when handled well. The process around it is where things go wrong. Someone has to change cartridges, and holidays and staff changes interrupt the routine. Media that has been through many cycles or stored poorly may not read. The offsite copy is only as fresh as the last collection, which for weekly rotation means up to a week of changes exist only on site. And a restore begins with a retrieval request, so the recovery time starts with a wait.
The step most often skipped is testing. A tape that has never been restored from is an assumption. Backup success versus recovery success explains why a completed write says little about a future read.
The property hardest to replace is the air gap. An online copy is, by definition, reachable. Storage-enforced immutability addresses the same threat in a different way: the copy can be reached, but it cannot be changed or deleted before its retention expires, by any account. Combined with separate credentials and network segmentation, it protects against the attacks an air gap was meant to stop, while keeping the copy available for immediate restore. Air gap versus immutability compares the two in detail.
The two are not identical. A physical air gap also protects against flaws in the storage software itself. Organizations with the highest assurance requirements sometimes keep a small tape or offline copy for that reason, alongside an online immutable one.
Distance comes from where the second copy is kept. There are three common choices. A second repository in another building or a colocation facility, fed by backup copy jobs over a network link. A cloud object storage bucket in another region. Or, for organizations with several offices, a repository at one site that receives copies from the others. The link has to carry each day's changes within the available window. Sizing the link for cross-site backup copies gives the arithmetic.
Grandfather-father-son retention does not depend on tape. Backup software can keep daily, weekly, monthly and yearly restore points on disk or object storage under the same scheme, and it can do so more efficiently, because unchanged data is not written again for each full. The retention schedule carries over as it is. What changes is that capacity has to be sized for all retained points being online at once.
Moving away from rotation is gradual. New backups go to the new offsite copy while existing tapes are kept until their retention ends. A reader for the old media has to stay in working order for as long as those tapes might be needed, and a restore from the oldest set should be tested before the drive is retired. Long-retention tapes can be left to expire in the vault or, if they are needed more often, restored and re-protected on the new platform.
ARTESCA is object storage software used as a backup target, deployed on servers the customer runs. Placed at a second site, it receives backup copies over the network and holds them under S3 Object Lock, where in compliance mode no account, including ARTESCA administrators, can remove a lock before it expires. That provides the offsite and tamper-resistant properties of rotated tape without media handling.
ARTESCA grows within the same deployment from roughly 50 TB to 8.5 PB and is used as a target for Veeam and other backup software.
Before rotation stops, four things should be true. The new offsite copy is in a different location from the primary. Immutability is enabled on it and has been verified. Its newest restore point is within the agreed age each morning. And a full restore has been run from it with the primary treated as unavailable. With those confirmed, the offsite copy does what the tapes did, and it is current to within hours.