Two ideas sit at the center of Hiberden: the 3-2-1 model for how many copies to keep, and verification for proving each copy is actually intact. Together they are what "Verified 3-2-1 Archiving" means.
The 3-2-1 model
3-2-1 is a simple, durable rule for not losing data: keep 3 copies of anything you care about, on 2 different kinds of media, with 1 copy offsite. It is the convention most people already know, and Hiberden is built to implement it honestly. The rule itself, where it came from, what counts as offsite, and its variants are covered in The 3-2-1 backup rule, explained; this article is about the verification Hiberden adds on top.
Hiberden works from a policy. A policy describes the protection shape you want: how many copies, and on which destinations. Each copy in the policy is bound to one destination from your shared pool of Destinations: tape, local disk, NAS, or cloud. When you archive, Hiberden writes the copies the policy calls for and tracks each one independently.
A typical 3-2-1 shape:
- Copy 1 on LTO tape, your archival spine, and an air-gapped offsite copy once the cartridge leaves the building.
- Copy 2 on local disk or NAS, fast to restore from.
- Copy 3 in your own S3-compatible cloud account, a second offsite copy. See Supported cloud providers.
That is three copies, more than two media types, and at least one offsite.
What "Verified" means
Three copies are only protection if each one is actually intact. In Hiberden, Verified is a claim the software has to earn, every time, by re-reading your data and re-hashing it. It is never assumed from a successful write, and when a status dot shows a copy as verified, that dot is reporting a read-back that actually happened, never standing in for one. This is the single most important idea in the product.
Read-back-and-compare
When Hiberden writes an archive, it records a SHA-256 hash of the contents. A copy is marked Verified only after Hiberden goes back to the destination, re-reads the stored bytes, and re-hashes them against that recorded SHA-256. If the hashes match, the copy is Verified. If they do not, the copy is flagged, not quietly trusted.
A copy that Hiberden only knows by identity, for example one adopted from an existing tape's index without a read-back, is marked Listed, not Verified. Listed means "we know it should be here"; Verified means "we re-read it and the bytes still hash correctly."
On-demand, across every destination
You can re-verify any copy on demand. Disk, NAS, cloud, and tape copies are all checked the same way. Each copy records the time of its last successful read-back, so you can see how fresh its verification is. Running a verification walks through the steps.
These per-copy results roll up into the coverage badge on each archive, so the workspace shows at a glance how many required copies are verified. See Reading coverage status.
What a tape re-read proves
On tape, Hiberden re-reads the cartridge through LTFS and re-hashes, proving the drive returned the same bytes that were written. That claim is stated exactly: it is a full read-back through the tape's own filesystem, not a shortcut over cached data Hiberden happens to hold.
Inform, don't act
When a re-verification finds a mismatch, Hiberden tells you. It does not rewrite, repair, or delete anything on its own. An archive tool must never silently change what you treat as immutable: it reports the truth and leaves the decision to you.
This is the difference between the 3-2-1 rule on paper and 3-2-1 you can trust.