Glossary: backup terms explained

3-2-1 rule: Three copies of the data, on two different media, one of them off site. The German Federal Office for Information Security (BSI) recommends this rule as the basis of every backup.
3-2-1-1-0 rule: An extension of the 3-2-1 rule: in addition, one immutable or disconnected copy (the second “1”) and zero errors in the tested restore (the “0”). AegisGrid writes to up to eight destinations in one run. More in the guide
Agent: The program on the computer being backed up that reads, splits, encrypts and writes the data to the destinations. The AegisGrid agent runs on Windows and Linux.
Air gap: A copy without a permanent connection to the company network, such as a disconnected USB disk or a tape. What cannot be reached cannot be encrypted by an attacker.
Backup server: A server that accepts and stores the backups of several computers. The AegisGrid backup server also processes them further: it checks, mirrors, exports and cleans them up and restores them as a test. More about the backup server
Check restore: An automatic test restore: the backup is restored to a test area, file systems are checked, files are read and VMs are started in an isolated environment. The result is recorded in a check report. More in the guide
Deduplication: Identical data is stored only once. AegisGrid splits the data by content (FastCDC) into chunks of 256 KiB on average and stores only chunks that are not yet in the store – across all backups and computers.
Destination (sink): A place a backup is written to: local disk, USB disk, NAS, backup server, S3 object storage or cloud storage. AegisGrid writes to up to eight destinations in one run and reads the source only once for this.
Differential backup: Backs up everything that has changed since the last full backup. Not needed with AegisGrid: thanks to deduplication every restore point is complete, yet only new data is transferred.
Encryption (end-to-end): The data is encrypted on the computer being backed up before it leaves it; the key stays with the customer. AegisGrid uses AES-256-GCM or ChaCha20-Poly1305.
Evidence log: A tamper-evident log of backups, restores, checks and deletions. In AegisGrid it is chained with SHA-256 and signed daily with Ed25519. More about evidence
GFS (grandfather-father-son): Retention by generations: daily, weekly, monthly and yearly restore points, each kept for its own period. This keeps a few old restore points for a long time without keeping every day.
Incremental backup: Backs up only what has changed since the last backup. Traditionally this creates a chain that must be complete for a restore. AegisGrid also transfers only changes, but stores every restore point completely, without a chain.
Mirroring: A complete copy of a store at a second location, for example on a backup server at another site. Only what is still missing there is transferred.
Ransomware: Malware that encrypts data and demands a ransom; modern attacks go after the backups first. Immutable and disconnected copies and tested restores protect against it. More in the guide
Restore point: The state of the backed-up data at one point in time; every backup creates a restore point. In AegisGrid every restore point is complete and can be restored on its own.
Resume: An interrupted backup continues where it stopped instead of starting over. Always active in AegisGrid, also after standby, shutdown or a lost connection.
Retention: The rule for how long backups are kept before they are cleaned up – by days or by generations. Configurable per destination in AegisGrid.
RPO (recovery point objective): How much data loss is acceptable at most, measured as time: with an RPO of 24 hours, backups must run at least daily.
RTO (recovery time objective): How long a system may be down at most until it is restored. The RTO determines how fast the restore must be and whether it has been tested.
Scrub: A check of all stored objects against their checksums, so that silent damage to the storage is noticed before it is needed. With a second copy, AegisGrid repairs damaged chunks.
Shadow copy (VSS): The Windows Volume Shadow Copy Service freezes the state of the drives while work continues. On Windows, AegisGrid always backs up from a shadow copy.
Snapshot: A frozen state of a drive or VM at one point in time, backed up while the system keeps running. On Linux AegisGrid uses LVM snapshots, on Proxmox VE the snapshots of the respective storage.
Store: The area where AegisGrid keeps the deduplicated chunks and restore points. Encryption, chunk IDs and retention apply per store.
WORM (write once, read many): Once written, neither changeable nor deletable until a lock expires. On the AegisGrid backup server, the server enforces the lock against all computers being backed up.

Terms of data backup

Questions about your backup?