14

I am planning to encrypt backup data using VeraCrypt. How safe are the generated containers? My worries is not so much the encryption, but potential data loss due to degrading harddisk media (bit rot) over time.

Currently I have an external USB Harddisk, and store each set of backup data twice, in separate folders, A and B. I do a bitwise comparison between A and B from time to time to proove the data integrity.

I plan to encrypt those backup data folders A and B into separate containers. Here are my questions:

  • Will the created containers still be bitwise comparable?
  • How robust will the containers be against data loss, e.g. when a (different) sector in each container fails, will the rest of the data still be extractable?
  • Can I purposedly have some extra redundancy in the container? (I know that this may degrade the encryption somewhat, but as said this is not may main concern).

Note: I like to have separate containers against having the whole drive encrypted to be able to handle the backup data sets individually.

Improve this question
3
  • 1
    How long are you expecting to store the data for in the same media?
    – Lie Ryan
    Commented Jun 25, 2016 at 5:22
  • @LieRyan I am planning for 10 to 15 years on the same media, while doing the comparison about every 6 months or so. Upon replacing the media, the containers will be moved to new media.
    – Marcel
    Commented Jun 25, 2016 at 20:18
  • 3
    I want to really stress the point I think Lie Ryan is making here. 10-15 years on a single HDD is a really, really long time. Chances are pretty good that at some point during those years, the drive will fail to spin up.
    – user
    Commented Jun 26, 2016 at 16:34

2 Answers 2

Reset to default
16

Will the created containers still be bitwise comparable?

No. Veracrypt stores different containers with different encryption keys, even if you use the same password. So the containers won't be bitwise identical. You'll need to open the container and compare the files rather than compare the container.

How robust will the containers be against data loss, e.g. when a (different) sector in each container fails, will the rest of the data still be extractable?

Veracrypt stores two copies of the volume metadata, one at the front, and one at the end of the volume. Additionally, you can backup the volume header to make it possible to restore the volume if both embedded metadata is corrupted.

Veracrypt encrypts in XTS mode, which means that data corruption in one block only affects that block.

However, you should consider that modern hard disk are very good at detecting and self correcting for errors. They do this by encoding the data in such a way that there are redundant information to allow the hard disk to recompute corrupted bits, the general technique is called error correcting code.

In addition, if you use a modern filesystem in your host system, like btrfs or zfs, modern filesystem adds additional checksums to automatically detect errors and they can also be configured on RAID configuration so they can automatically make redundant copy when storing files so they can automatically repair errors to protect against media degradation. Due to their design, it's nearly impossible that you'll get silent corrupted data due to media degradation with modern filesystem.

The only practical failure scenario for modern filesystem is bugs in the filesystem implementation and user errors. You have a much better likelihood of accidentally rm -f container.tc-ing your data. And for a catastrophic physical disk failure where the entire hard disk just stopped working, in which a backup on the same device would not be able to help you. To protect against these, you would want to make a backup copy of your data on multiple devices and migrate to a new storage media probably once every 5-7 years.

Improve this answer
0
0

I use free ExactFile to calculate and store a hash value for each file stored on backup media. I use Samsung FIT+ mini flash drives. I do not use hard disk drives any more.

Then, I can run a file verification operation periodically to check data integrity. This is known as an active archive.

Instead of comparing two copies of the same file, bit for bit, you compare the current computed hash value with the stored expected hash value, which is much quicker.

I keep multiple copies of backup files on separate flash drives and on Proton Drive encrypted cloud storage.

Improve this answer
7
  • ExactFile is end-of-life and no longer being maintained - also, as far as i'm aware it doesn't sign the digests of the files, which leaves them open to subsequent interference .. i recommend switching to openssl.exe or certutil.exe for producing digests, and ssh-keygen.exe for signing the digest-files ; these are available in git for windows - also Portable-git - start git-bash.exe and from there you can use these programs against your filesystem
    – brynk
    Commented Mar 13, 2023 at 8:43
  • Yes, ExactFile is old software, but it is a free hash generator/checker that works fine for my personal/small business needs. I don't need signed hash values.
    – user290212
    Commented Mar 13, 2023 at 16:41
  • Files stored in a VeraCrypt container are protected from tampering. Robust archiving software should also keep a directory file count, to detect added or deleted files, known as fixity. There is software named Fixity that was once free software, but is now paid software. Acronis True Image backup software includes stored blockchain hash values and a scheduling periodic data check feature.
    – user290212
    Commented Mar 13, 2023 at 17:23
  • in what way does veracrypt protect files at rest from being tampered with? my understanding is you would need a separate mechanism to make this guarantee - either on the individual files themselves, or on the container file as a whole (or both)
    – brynk
    Commented Mar 14, 2023 at 1:45
  • actually, we're debating a side issue anyway - nothing in this answer contributes to recovering from bit-rot or corruption - what is really needed is some form of forward-error correction applied to the data at rest in the veracrypt container (i managed to get zfec working in py3 without too much trouble- it's probably off topic here)
    – brynk
    Commented Mar 14, 2023 at 2:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .