I have a shoebox of negatives my grandfather shot in the 1950s. I can hold them up to a window today, sixty-plus years later, and see every image. Meanwhile, a CD of wedding photos I burned in 2004 now reads as a blank coaster in two of my three drives. That contrast taught me the central lesson of digital preservation the hard way.

Here it is, plainly: no storage medium or file format lasts forever. Not gold discs, not “archival-grade” hard drives, not the cloud. A durable archive survives because it is actively monitored, copied, verified, documented, and periodically migrated — not because it was written once to supposedly permanent media.

In this guide, I’ll walk you through the formats worth trusting, the media worth using (and their real weaknesses), and the habits that separate an archive that lasts from one that quietly dies on a shelf. Everything here comes from twenty years of managing my own photo library and the scars to prove it.

Formats That Survive: Pick Open, Lossless, and Boring

Long-term archiving starts with formats that are openly documented, non-proprietary, lossless, and easy to validate. A format survives because software to read it stays widespread — not because a vendor promised it would. The safest choices are almost always the boring, ubiquitous ones: plain text, TIFF, WAV.

Think of it this way. A RAW file from a 2006 camera needs that manufacturer’s specific decoder, and camera makers retire support quietly. A 16-bit TIFF from the same year opens in literally anything. Both hold the pixels; only one holds your future options.

The rules I use when picking a preservation format:

• Openly documented — anyone can write a reader for it, not just one company
• Lossless when the original matters — no quality thrown away at save time
• Self-contained — color profiles, metadata, and fonts embedded in the file
• No encryption, DRM, or macros — anything that adds a dependency adds a failure point
• Easy to convert later — you will migrate eventually; make it painless

For photos specifically, I keep camera RAW originals as evidence, then create 16-bit TIFF or high-quality JPEG 2000 preservation copies. The RAW is the negative; the TIFF is the print that any future machine can read.

One caution on PDF/A: it’s useful but not magical. It embeds fonts and improves self-containment, but you still need to validate the files. PDF/A-4, based on PDF 2.0, is the newer flavor — check that your tools support it before committing. And always keep the original editable file next to the PDF/A copy, because conversion can quietly drop formulas, interactivity, or layout features.

The Truth About Hard Drives, SSDs, Tape, and Discs

Every storage medium fails — the question is how and when, and whether you’ll have a working reader when it does. The likely lifetime of the reading technology is often shorter than the advertised lifetime of the medium itself. Your “100-year” disc may be fine in 2085; the drive that reads it may not exist.

Hard drives are economical for storage you keep online, but mechanical failure is expected, not exceptional. A single unplugged drive on a shelf is a gamble, not an archive. Data recovery labs will tell you the most common story they hear is “it worked when I put it away.”

SSDs and flash drives are the ones people get wrong most often. They are fast and convenient but poorly suited as unattended shelf archives. Unpowered data retention varies with age, wear, temperature, and device quality — a worn SSD left in a drawer for years can lose charge and lose data. I use SSDs for working storage, never for cold archives.

LTO tape is the workhorse of large institutional archives: high capacity, offline protection from ransomware, low cost per terabyte. The tradeoffs are real, though — you need compatible drives, careful environmental storage, and planned migration between tape generations, since an LTO drive typically reads only one or two generations back.

Optical discs work for modest collections if you use high-quality write-once media, but capacities are small and drives are getting scarce. Treat extraordinary longevity claims — the “1,000-year” discs — with healthy skepticism.

Cloud archival storage gives you geographic redundancy and managed infrastructure, but it is a service, not permanent media. Retrieval charges, account continuity, and provider dependence all matter. And microfilm and archival paper? Still genuinely valuable for human-readable records — properly made microfilm reads for generations with nothing but light and a lens.

Here’s my rule of thumb after losing a drive full of 2009 client work: treat every storage medium as replaceable, and design your system so any single one can die without consequence.

The 3-2-1-1-0 Rule That Saves Your Photos When Disaster Strikes

The baseline strategy for resilient archives is the 3-2-1 rule: three copies of your data, on at least two types of storage, with one copy in another location. The modern, stronger version adds two more numbers — 3-2-1-1-0 — meaning one copy is offline, immutable, or otherwise isolated, and zero uncorrected verification errors.

Why the extra “1”? Ransomware. Criminals now specifically target backup drives connected to the network, and cloud sync services can faithfully propagate encrypted, corrupted files everywhere within minutes. An offline copy — a disconnected drive, a tape in a drawer — is the one thing malware cannot reach. PhotoMocha’s guidance is blunt on this point: three copies accessible through one compromised account are not truly independent.

Here’s how I run it for a roughly 12-terabyte photo library:

1. Working copy on a RAID array in my studio — fast, always online
2. Second copy on a separate external drive, synced monthly
3. Off-site copy at a family member’s house, swapped every quarter
4. Immutable copy in cloud storage with object-lock enabled, so nothing can be deleted or overwritten for a fixed retention period
5. Verification pass — checksums compared across all copies before any old copy is cleared

Use different administrative credentials for each location where you can. Geographic separation protects against fire and flood; credential separation protects against the quieter disaster of a single hacked account wiping everything at once.

One more distinction worth burning into memory: RAID is not backup. RAID improves availability when a drive dies, but it does nothing against deletion, ransomware, software faults, or an administrator error. I learned that watching a photographer friend rebuild a RAID array that had faithfully mirrored his own accidental deletion, in perfect redundant real time.

Checksums: How to Know Your Files Haven’t Quietly Corrupted

A checksum is a cryptographic fingerprint — typically SHA-256 — computed when a file enters your archive. Recalculate and compare those checksums periodically, and you can detect unintended change before it becomes permanent loss. This process is called fixity checking, and it’s the difference between an archive you trust and a pile of files you hope are fine.

Here’s the scenario that motivates it. You copy 40,000 photos to a new drive. The copy “succeeds.” But one cable glitch, one bad sector, one silent write error — and a handful of files are subtly damaged. No error message. No warning. Six years later you open a family portrait and half the frame is grey mush. Without checksums, you’d never know which files rotted or when.

The workflow is simple enough for any hobbyist:

1. Generate SHA-256 checksums for every file at ingest, using any standard checksum tool
2. Store the checksum manifests separately from the files they describe
3. Recalculate and compare on a documented schedule — annually works for most personal archives
4. Investigate every mismatch immediately, and restore from a verified copy
5. Record every repair and migration in a simple log

Know the limits, though. Checksums detect changes; they do not repair damage. Recovery requires another verified copy or error-correcting storage. And a matching checksum only proves the bytes haven’t changed — not that the file was ever valid, correctly described, or meaningful. Combine fixity checks with format validation and restoration tests for a complete picture.

Copying files does not renew them automatically. Copying helps only if the result is verified and the process preserves metadata and detects prior corruption.

Metadata and Migration: Give Your Files a Future

A file without context may be technically readable but practically meaningless. Future-proofing means attaching who created it, when, what it is, and how it relates to everything else — before you forget. The photo of strangers at a beach means nothing in 2040 if nobody records that it’s your parents’ honeymoon.

You don’t need institutional software for this. Consistent filenames, a simple inventory spreadsheet, and embedded metadata go shockingly far. Big archives use standards like PREMIS, METS, Dublin Core, and BagIt packages — worth knowing about, overkill for a family collection.

What to record, at minimum:

• Creator and creation date — the basics everyone skips
• Title, description, and rights — who may use this, and how
• File format and software requirements — what opens it
• Provenance — where it came from and who has handled it
• Checksums and validation results — your fixity history
• Migration and repair history — every conversion, documented

Then plan for migration, because you will need it. Migration means converting files into newer formats before the old ones become unreadable — it works beautifully for documents, images, audio, and datasets. Emulation means recreating the original software environment so old content behaves as intended — essential for software, games, and interactive art whose behavior can’t be captured by conversion alone.

Most organizations plan technology reviews every few years and migrate on a five-to-ten-year horizon, depending on the medium. When you migrate, keep the originals wherever legally and technically possible. The original is evidence; conversion is convenience. I keep every RAW file I’ve ever shot, even ones I’ve converted to DNG, because I don’t trust any converter to carry every byte of sensor data forever.

Test Your Restores — An Untested Archive Is a Hope, Not a Plan

An archive is only credible if you can actually recover from it. Restoration testing confirms that files can be located and retrieved, that checksums match, that encryption keys still exist, and that formats still open in available software. Do this on a schedule, not on the worst day of your life.

I run a restore drill twice a year: pick twenty files at random from the inventory, pull them from the off-site copy, verify checksums, and open them in current software. It takes an hour. The first time I did it, I discovered my off-site drive had been formatted with a filesystem my laptop could no longer write to — a small problem that would have been a crisis during an actual emergency.

A real restoration test checks six things:

• Files can be located and retrieved — the inventory actually matches reality
• Encryption keys and credentials are available — and not just in one person’s head
• Checksums match — the copies are bit-for-bit intact
• Formats open in current software — no format rot hiding in the collection
• Relationships between files remain intact — sidecar files, folders, and links survive
• Recovery procedures are understandable — to someone other than you

That last point is the one nobody wants to think about. If something happened to you tomorrow, could your partner or family recover the archive? Write the procedure down. Include account names, key locations, and the plain-language steps. An encrypted archive with a lost passphrase is permanently unreadable — encryption protects confidentiality, but lost keys make an intact archive worthless. If policy allows, keep a protected preservation copy that doesn’t depend on any single personal password.

A healthy archive has a current inventory, verified checksums, multiple independent copies, readable formats, tested recovery procedures, and a named person responsible for continuing maintenance.

Frequently Asked Questions

How long do hard drives, SSDs, tapes, and discs actually last?

There is no dependable universal figure. Device quality, prior use, temperature, humidity, and handling all matter. Operational hard drives are typically replaced on cycles measured in a few years; tape and optical media can retain data much longer, but drive compatibility often forces migration earlier than the media itself would require. Plan for the reader, not just the disc.

Is there a single best archival medium?

No. The best system uses multiple independent media with planned migration. Large archives commonly combine disk or object storage with LTO tape. For personal collections, multiple verified drives plus an off-site or cloud copy is more practical. Any single medium is a single point of failure.

Is PDF/A the best format for every document?

No. PDF/A excels at preserving final-form documents, but conversion can lose editable structure, formulas, data, or interactivity. Preserve the original file alongside a validated PDF/A copy when both functions matter.

Should I compress files in my archive?

Lossless compression is safe — it preserves information exactly. Avoid obscure archive utilities, encrypted containers without strong key management, and huge monolithic packages where damage to one container could affect thousands of files at once. Lossy compression is fine for access copies, but keep it away from preservation masters.

How often should I check and replace my archive media?

Let risk set the schedule. Automated systems can check continuously; offline media is typically inspected annually. Replace or migrate media before failure rates climb or compatible hardware gets scarce — many organizations migrate on a five-to-ten-year horizon. Always verify media before and after any migration.

Can a cloud provider delete or lose my archived data?

Cloud platforms are generally resilient, but accounts get closed, credentials get compromised, contracts change, payments are missed, and users delete things by accident. Maintain independent copies outside the provider, and test your export procedure before you ever need it.

Conclusion

If you remember one thing, make it this: the most durable archival strategy is not “store and forget” — it is select, document, duplicate, verify, test, and migrate. Start with your irreplaceable material first: family photos, recordings, writing, legal records. Clear filenames, honest metadata, and one off-site copy put you ahead of ninety percent of people by this weekend.

My grandfather’s negatives survived because they needed nothing but light to be seen. Your digital archive will survive because you keep it moving — copied, checked, and carried forward, generation after generation. The best day to start was ten years ago. The second best is today.