Backup and redundancy
The 3-2-1 backup rule for video footage.
Three copies, two kinds of media, one somewhere else.
Keep three copies of every file you cannot reshoot, on at least two different kinds of storage, with one copy away from the building. On a shoot that means the card is copied to two drives before anyone formats it, and one copy of what matters leaves the office. Here is the rule applied to a real job, why a RAID counts as one copy, and why a hosting account is not a copy you own.
Video hosting for filmmakers · 5 GB free · Paid plans from USD 9/month
By uncompressed.io · Updated September 2026
The rule
Three copies,
two media, one off site.
US-CERT sets out the 3-2-1 rule in its paper on backup options and credits it to Peter Krogh’s The DAM Book. It is short enough to remember on set, which is the point.
3 copies
The primary file plus two backups. The working copy counts as one of the three, so one backup is not enough.
2 kinds of media
The copies live on at least two different types of storage, so one hazard, such as a bad batch of drives or a failing controller, cannot take them all.
1 off site
One copy sits outside your home or business, so a fire, a flood or a break-in at one address leaves a copy standing elsewhere.
The paper’s wording for the last line is “Store 1 copy offsite (e.g., outside your home or business facility).” It also warns that rolling backups, which overwrite the backup with the latest version of the primary, can silently carry corruption or malware from the primary files into the backups. On a video job that matters more than on most, because a corrupt clip usually goes unnoticed until someone scrubs to it in the edit.
Applied to a production
From the card
to the day the job is delivered.
Offload the card to two drives
Copy each card to two separate drives, not two folders on one drive, with a copy tool that checks every file after writing. Label the card as offloaded only when both copies check out.
Format only after both copies exist
Until then the card is one of your copies. Reuse it only after the second drive is written and checked, and never format a card on the strength of a progress bar.
Edit from one, park the other
The edit runs from one drive or array. The second drive is disconnected and kept apart from it, so a wrong delete, a failed write or a power surge cannot reach both.
Send one copy off site
At least one copy of what a reshoot could not replace leaves the building: a drive at another address, tape, or rented storage. For most jobs that is the delivered master, the project and the selects.
Two different kinds of media: for example, spinning drives for copies 1 and 2 and tape or rented storage for copy 3, or a drive for one local copy and an array for the other. The rule counts types of storage, not the number of boxes.
The common mistake
A RAID is not a backup,
it is one copy that survives a dead disk.
A mirrored or parity array keeps working when one disk fails. That is its whole job, and it is a good one for the drive the edit runs from. But the array writes every change to every disk at once: a deleted folder, an overwritten clip or a corrupted file is deleted, overwritten or corrupted everywhere in the set in the same instant. A controller fault, a bad firmware update, a power surge or a theft takes the whole enclosure with it.
So count the array as copy 1, however many disks it holds. The two backups still have to exist on other storage, and one of them still has to leave the building.
Plainly
A hosting account is not
a copy you own.
A video host, a review tool or a file-sharing account is a place where a file is shown to people. It is not a copy you own. It depends on a subscription staying paid, on terms that can change, on an account you can be locked out of, and on a company’s decisions about storage you cannot see. Treat any hosted file as a convenience, never as the only copy of a master, and never as more than one of your three.
That applies here too. On our free plan, accounts are cleared after 90 days without a sign-in or a view, with an email warning first. Paid plans carry archive storage, and a cold copy there can be your off-site copy, but this page makes no promise about how long a copy is kept after a plan ends. Keep your two local copies either way.
Where cold storage fits
The off-site copy
of what a reshoot could not replace.
On a paid plan, the delivered master and the selects can go into the archive beside the film you delivered. That makes it copy 3, off your premises, in object storage in an Eastern North America region, encrypted at rest.
100 GB
Archive on Lite
$9 a month
500 GB
Archive on Pro
$39 a month
2 TB
Archive on Max
$99 a month
7 TB
Archive on Studio
$199 a month
What happens when a file moves
Hot capacity is released after the archive copy is verified and the library change is saved. Archived films must be restored before streaming, embedding or review. The check on the move confirms the copy arrived at its full size; it is not a checksum comparison, so keep your own checksums for the drives.
Getting it back
Restoring requires available hot capacity and uses a monthly allowance of twice your archive capacity. Transfer time depends on file size and the transfer path; no fixed completion time is guaranteed. A single file can also be downloaded straight from the archive without restoring it first.
What it costs beyond the plan
Archive extras cost $20 per TB per month on any paid plan, including Lite and Pro. Storage extras stay monthly even with an annual base plan. Included archive by plan: Lite 100 GB, Pro 500 GB, Max 2 TB, Studio 7 TB. The free plan has no archive.
From inside the editor
A finished edit can be archived straight from DaVinci Resolve, Premiere Pro or Final Cut Pro as one pack per timeline (the clips the timeline uses, whole, the project file and the master) into the cold archive of any paid plan, and every file in the pack is restorable on its own. Uploads and transfers resume from the last part that arrived.
When this is the wrong tool
At $20 per TB a month for extra archive, this is not built for a decade of full rushes that nobody will open. For that, price tape or a deep archive service you run yourself; the hot versus cold breakdown explains the difference between the two tiers. What the archive here is good for is the small, valuable set: the master and selects that sit next to the film a client clicks, one restore away from the review room. The archive pass guide covers what goes into that set and what to delete.
The arithmetic
Size three copies
before you buy the drives.
The rule triples whatever you shot, so size it early. Apple’s ProRes white paper lists ProRes 422 HQ at 3840 x 2160 and 24p at a target of 707 Mb/s, about 318 GB an hour. One hour of that footage is roughly 954 GB across three copies, before proxies, caches or renders, which are rebuilt from the originals and do not need three copies of their own. ProRes rates vary with image content, so treat the figure as a target, not a ceiling.
The practical split on most jobs: all rushes on the working drive and the local backup; the off-site copy holds the delivered master, the project file and the selects, which is far smaller. If the contract says every card must survive off site, size the third copy for everything and price tape or a self-run bucket against it.
Questions
Frequently asked
Can I format the card after one copy?
No. Until there are two copies on two separate drives, the card is still one of your copies. Format it only after both copies exist and you have checked them, ideally with a copy tool that compares checksums rather than just file counts.
Is a sync folder a backup?
Not on its own. A sync or rolling backup copies whatever the primary files look like now, so the US-CERT paper warns that rolling backups can pass corruption or malware from the primary files into the backups. Keep at least one copy that is written once and left alone, and keep older versions where your tool allows it.
Do two drives in the same bag meet the rule?
They meet the three copies, not the one off-site. A bag, a car or an office can be lost, stolen or flooded in one event. The off-site copy has to be somewhere a single incident at your location cannot reach: another address, or storage you rent outside the building.
Should every card go to the cloud?
Usually not. Full rushes are the bulkiest part of a job and the cheapest bytes are the drives you already own. Put what a reshoot could not replace off site first: the delivered master, the project file and the selects that made the cut. If the contract or the client needs every card kept off site, price a tape set or a deep archive service you run yourself against it before choosing.
Does a cold copy here count as the off-site copy?
It can count as one copy of three, off your premises, for as long as your paid plan is active and under the Terms. Restoring requires available hot capacity and uses a monthly allowance of twice your archive capacity. Transfer time depends on file size and the transfer path; no fixed completion time is guaranteed. This page makes no promise about how long a copy is kept after a plan ends, so keep your own two copies as well.
An off-site copy beside the delivered film
Max includes 1 TB hot and 2 TB archive; Studio includes 1 TB hot and 7 TB archive. Archive extras cost $20 per TB per month on any paid plan, including Lite and Pro. Storage extras stay monthly even with an annual base plan. Hot capacity is released after the archive copy is verified and the library change is saved. Archived films must be restored before streaming, embedding or review.
Sources
- 1.US-CERT, Data Backup Options (Ruggiero and Heckathorn, 2012, hosted by CISA): the 3-2-1 rule and rolling-backup risks (fetched 17 September 2026)
- 2.Apple ProRes White Paper (April 2022): target data rates, 3840 x 2160 at 24p (fetched 17 September 2026)