Why is RAID not a backup?

RAID is not a backup because RAID only protects you from a disk failure: if a file is deleted, corrupted or encrypted by ransomware, the change immediately reaches all the disks. A backup is a separate copy of your data, from which you can restore it as it was before the problem.

Cyberattacks are increasingly frequent, and companies are implementing increasingly advanced security and backup solutions. And yet many people think that if they have a RAID system, they also have a backup.

In this article, we’ll discuss RAID and backup. More precisely, we’ll explain why every company needs both technical solutions and why one can’t replace the other.

I think every IT manager has had to explain to a client at least once that “RAID is not a backup.”

RAID: what it is and what it’s for

RAID (Redundant Array of Independent Disks) means “combining” several disks, hard drives (HDDs) or SSDs, so they work as one. It can be configured in hardware or in software.

As the name suggests, configuring disks in RAID provides redundancy or better performance (depending on the type of RAID chosen), not a data backup function.

Servers usually have dedicated RAID controllers, while the NAS systems used in many offices configure RAID in software. If you choose one of these devices, see also the article on the best NAS for companies.

Types of RAID

RAID 0 (Striped Set)

RAID 0 is usually used to increase read and write speeds. The data is split into blocks, which are written in turn across all the disks configured in RAID 0, and this improves performance.

If one of the disks fails, all the information is lost, so implementing a backup solution is crucial to ensure data integrity.

To configure RAID 0, you need at least two disks.

RAID 1 (Mirrored Set)

RAID 1 is used to reduce the chances of losing data in the event of a hardware failure. The same data is written to all the disks, so if one of them fails, the data can be read from the others.

To configure RAID 1, you need at least two disks.

If the same data is written to both disks, why isn’t RAID 1 a backup solution too?

RAID 1 lets you completely replace a damaged disk without losing data. But if the system is infected with ransomware or the data becomes corrupted, it will be compromised on all the disks. We recommend implementing a backup solution for servers and systems that use RAID 1 as well.

Other types of RAID:

• RAID 5: uses at least three disks. If one of them fails, the data can still be read from the others, without stopping work. But be careful: until the replacement disk is rebuilt, which can take many hours with large disks, a second failed disk means losing all the data.
• RAID 6: uses at least four disks and provides redundancy even if two of the disks fail at the same time.
• RAID 10 (RAID 1+0): a combination of RAID 1 and RAID 0, with at least four disks. It keeps the data accessible if a disk fails and offers better performance.

Backup as a Service: tell me more →

Why is RAID not a backup?

As we said earlier, using several disks configured in RAID lets you access your data even if one of the disks fails. In most cases, replacing the damaged disk is also easy, with very little downtime compared with the time it takes to restore data from a backup.

RAID ensures your data stays continuously accessible, even if a disk fails. But it doesn’t protect you from accidentally deleting a file, from ransomware, from a failure of the controller or the entire device, from fire or from theft.

A backup lets you easily restore your data if it becomes inaccessible or is encrypted by ransomware.

What backup does a company that uses RAID need?

A backup that’s separate from the server, with several versions of the data and at least one copy that an attacker can’t modify or delete. Specifically:

• The 3-2-1 rule: three copies of the data, on two different types of media, one of them in another location. Details in the article on the 3-2-1 backup policy.
• An immutable or disconnected copy, which ransomware can’t encrypt, even if it reaches the server.
• Several restore points, so you can go back to the data from before the infection or deletion, not just to yesterday’s data.
• Regularly tested restores: a backup you’ve never restored is just a hope.
• Backup monitoring, so a failed backup is noticed the same day, not when you need it.

See also the types of backup and why you need them.

RezolvIT provides IT outsourcing and successfully supports the companies it works with, whether that means Backup as a Service and IT security, or making it easy for employees to work remotely. If you want to know whether your company’s data can be restored, request a free IT audit.