Verified 3-2-1 Archiving
Updated July 4, 2026
Two ideas sit at the center of Hiberden: the 3-2-1 model for how many copies to keep, and verification for proving each copy is actually intact. Together they are what "Verified 3-2-1 Archiving" means.
The 3-2-1 model
3-2-1 is a simple, durable rule for not losing data: keep 3 copies of anything you care about, on 2 different kinds of media, with 1 copy offsite. It is the convention most people already know, and Hiberden is built to implement it honestly.
Hiberden works from a policy. A policy describes the protection shape you want: how many copies, and on which destinations. Each copy in the policy is bound to one destination from your shared pool of Destinations: tape, local disk, NAS, or cloud. When you archive, Hiberden writes the copies the policy calls for and tracks each one independently.
A typical 3-2-1 shape:
- Copy 1 on LTO tape, your archival spine, and an air-gapped offsite copy once the cartridge leaves the building.
- Copy 2 on local disk or NAS, fast to restore from.
- Copy 3 in your own S3-compatible cloud account, a second offsite copy. See Supported cloud providers.
That is three copies, more than two media types, and at least one offsite.
What "Verified" means
Three copies are only protection if each one is actually intact. In Hiberden, Verified is a claim the software has to earn, every time, by re-reading your data and re-hashing it. It is never assumed from a successful write, and it is never implied by a status dot. This is the single most important idea in the product.
Read-back-and-compare
When Hiberden writes an archive, it records a SHA-256 hash of the contents. A copy is marked Verified only after Hiberden goes back to the destination, re-reads the stored bytes, and re-hashes them against that recorded SHA-256. If the hashes match, the copy is Verified. If they do not, the copy is flagged, not quietly trusted.
A copy that Hiberden only knows by identity, for example one adopted from an existing tape's index without a read-back, is marked Listed, not Verified. Listed means "we know it should be here"; Verified means "we re-read it and the bytes still hash correctly."
On-demand, across every destination
You can re-verify any copy on demand. Disk, NAS, cloud, and tape copies are all checked the same way. Each copy records the time of its last successful read-back, so you can see how fresh its verification is.
An honest note on tape
On tape, Hiberden re-reads the cartridge through LTFS and re-hashes. It does not claim that this re-read bypasses the drive's internal read cache. Cache-bypass (direct-device) verification is a separate, post-launch capability. We would rather state exactly what the re-read proves than imply more than it does.
Inform, don't act
When a re-verification finds a mismatch, Hiberden tells you. It does not rewrite, repair, or delete anything on its own. An archive tool must never silently change what you treat as immutable: it reports the truth and leaves the decision to you.
This is the difference between the 3-2-1 rule on paper and 3-2-1 you can trust. See also What Hiberden is.