摘要 · Summary

Digital Preservation · Research BriefConsumer advice, measured · 2026

Executive summary · one-page brief

Three Copies Are Not Enough — Verify the Bytes

The standard advice for keeping digital photos — three copies, one off-site, and check that the backup ran — guards against the losses that are easy to imagine: a dropped phone, a closed service, a full free quota. It does not guard against the loss its own readers describe in the comments: a disc or a drive still in your hands that simply no longer decodes. The advice never asks whether the bytes are unchanged, nor whether anything will still read the medium in twenty years. Two additions close the gap. Record what every file should hash to and re-check it on a schedule — checksums detect corruption, redundancy repairs it, neither alone suffices. And judge every medium by the minimum of its rated life and how long a reader will exist — the second is almost always shorter, and nobody publishes it.

By the Numbers retention · governance · permanence

1 yearspecified power-off retention floor for a client SSD at 30 °C — and it halves for every 5 °C warmer
0mentions of a checksum, of fixity, or of verifying file contents anywhere in the source article
LTO-10a tape rated near thirty years, whose drive reads no earlier generation of media at all
~200 yrrated permanence of a pigment inkjet print — the one medium whose reader cannot be discontinued

Where the Standard Advice Stops four failure modes, two blind spots

Failure mode	Caught?	What actually catches it
Device lost or broken	Yes	A second independent copy — the oldest advice in the field, and still the best.
Service closes, quota fills	Partly	An off-site copy saves the pixels. An export routinely keeps the pixels and loses the tags, ratings and albums.
Bytes change in place	No	Stored hashes re-verified on a schedule; a checksummed filesystem scrubbed monthly; recovery blocks at five to ten per cent.
Nothing reads the medium	No	Choosing media by reader availability rather than rated life — and migrating before the reader disappears.

What Follows 起 · 承 · 轉 · 合

Beat	Page	What it covers
起 · 承 Context	2	The three requirements a photo has, why they compose as a minimum, and what each medium is really rated for.
轉 Pivot	3	The two omissions that change the advice: verifying content, and format support as governance rather than decay.
合 Resolution	4	How a photo service actually fails you — five mechanisms — and the routine that survives all of them.

Bottom line

Copies protect against events. Only verification protects against time. Three copies of a silently corrupted file are three corrupted files — and sync will have distributed the damage for you, on schedule, exactly as designed.

Reframe

Do not ask how long a medium lasts. Ask how long something will still read it — and whether you would notice the day that stops being true.

起承 · Context · Content 1 / 3

起 — Three Requirements, One Minimum the frame, and the correction it needs

The shoebox frame · as argued
Device, Service, Format
remove any one and the photo is gone
- A print needed no electricity, no password and no subscription. A digital image needs a working device, a running service and a readable file format.
- Loss comes by neglect, not catastrophe — and the claim that most people will lose some photos is not alarmism.
- Syncing only mirrors the current state, so one deletion reaches every device. Independence, not replication, is what makes a backup.
- Free quotas fill silently, services close, and an unpowered SSD is a genuinely poor archive. All three hold up against the evidence.
The correction · a minimum function
min(medium, reader)
the shortest term governs the rest
- Those three requirements are not three risks to mitigate separately. They compose as a minimum: the shortest term decides, and the others stop mattering.
- A hundred-year disc is worth nothing without a drive — and vendors break reader compatibility deliberately, not by accident.
- A print is exceptional not because paper lasts, but because its reader cannot be discontinued. An eye is never end-of-life.
- Readable and archival are different properties: the top-preference still-image format of a national library is, per MDN, supported by one browser.

承 — What Each Medium Is Rated For figure · provenance · the real constraint

Medium	Rated retention	Where the figure comes from	The real constraint
Client SSD, unpowered	1 yr @ 30 °C	A JEDEC standard, read via four secondary sources — the primary document was unreachable.	Halves every 5 °C; about one week in the worst charted case.
HDD, unpowered	unpublished	No manufacturer specification was found; the available sources contradict each other.	Lubricant migration and head stiction, not magnetic decay.
HDD, running	1.36 % / yr	A large operator's 2025 fleet statistics, published annually.	Measured with proactive replacement, not by leaving drives alone.
Recordable optical	grade-dependent	An ISO test method that models temperature and humidity only.	Dye chemistry and manufacturing batch beat the format letters.
Inorganic optical	100+ to 1,000 yr	The lower figure is an institute's rating; the upper is vendor extrapolation.	Today's retail formulation is disclosed by nobody, so nobody can verify it.
LTO-10 tape	~30 yr	A reseller page — the standards body's own site carries no such figure.	The drive reads LTO-10 media only, by deliberate design.
Pigment inkjet print	up to ~200 yr	A testing house's ratings, quoted in the ink maker's own press release.	Resolution, capacity and cost per image — not longevity.

Two of those rows carry the whole argument. LTO-10 is a thirty-year medium behind a drive that reads nothing else — the compatibility break was deliberate, made to accommodate a new head design, and it ended a long run in which every generation could read two generations back. The consumer version of the same wall is already in the source article's own comment thread, where a reader reports losing photos to plain operating-system incompatibility. Rated life is the number vendors publish, because it is the flattering one; reader availability is the number that actually expires, and nobody publishes it at all.

2 → 0generations of older tape a drive once read back — LTO-10 reads none
×½ / 5 °Cof an unpowered SSD's retention, lost per 5 °C of storage warmth

轉 · Pivot · Content 2 / 3

轉 — The Loss Nobody Verifies detect, then repair — neither alone suffices

The standard verification step is “check that the backup is really running”. That confirms the job ran; it says nothing about whether the bytes are still the bytes. Silent corruption is measured and non-zero — a hard drive's uncorrectable bit error rate is commonly quoted at a level implying an expected error roughly every hundred terabytes read, which on a modern high-capacity drive is only three or four complete passes. Photographs are unusually exposed to it, because JPEG's entropy coding is variable-length: a single flipped bit corrupts every symbol until the next synchronisation point, and ordinary decoders make no attempt to resynchronise even though the format would partly allow it. Notice which failure this is: the file is present, the backup ran, every copy sits where it should — and the photograph is gone anyway. The discipline that catches it is fixity, which preservation institutions treat as a named, recurring function, one of five areas in their own maturity model. Its rule is worth memorising: checksums detect corruption, redundancy repairs it, and neither alone is sufficient.

4 monthsthe outer limit between integrity scrubs; monthly is normal practice
5–10 %recovery-block overhead that repairs damage without a second full copy

Where the Advice Holds, Where It Strains six claims, graded against the evidence

Claim	Holds	Strains
Syncing is not backup	Exactly right, and the most valuable sentence in the piece.	Cloud deletion clocks go unmentioned: inactivity and over-quota can both trigger removal.
SSDs lose data unpowered	Correct, and understated — the specified floor is one year, not “years”.	No figure is given, so a reader cannot tell it is the hardest claim in the article.
JPEG stays readable	Vindicated: JPEG, PNG, GIF, WebP and BMP are in all versions of every major browser.	The risk it names — “exotic formats” — is the wrong one. It is proprietary camera RAW, the default output of mainstream cameras.
3 copies, 2 locations, 1 off-site	Three copies with one off-site is sound, and better than what most people actually do.	The canonical rule says two different media. Two drives are not two media, however far apart they sit.
Organise by year and occasion	The most durable recommendation of the six: the filesystem is the only part you own outright.	Never says organisation can be lost separately from pixels — which is precisely what a provider export does.
Print the ones that matter	Right — and the only medium here that depends on no reader at all.	Framed as a sentimental extra, though its rated permanence far exceeds “decades”.

Format Support Is Governance, Not Decay a chronology of decisions, not of wear

2008A professional photo-archive service gives customers roughly 24 hours of notice, and briefly serves a placeholder image in place of their own photographs.
2019A large photo host cuts free accounts from 1 TB to 1,000 items, then actively deletes the excess, oldest upload first.
2020A camera maker's service closes in an orderly way: pixels are exportable, but tags, ratings, titles and albums are not included, and are lost.
2020At the same maker, a migration bug destroys long-term originals. The remedy is to restore 2048-pixel thumbnails as the original files.
2021Free unlimited backup ends at the largest consumer photo service; the surviving free tier recompresses whatever you upload to it.
2022A major browser removes support for a modern image format it had already shipped, citing low interest. Support does not decay; it is withdrawn.
2023A rival browser ships the very format the first had deleted — partial support only, but the first real break in a unanimous rejection.
2026The format returns to the first browser behind an experimental flag — and an open, checksummed archival RAW format finally becomes an ISO standard.

合 · Resolution · Content 3 / 3

合 — How a Service Actually Fails You five mechanisms, not one

Mode	What happens	Survives	Lost
Sudden death	Financing fails. Notice is measured in hours, and the servers are overloaded by everyone downloading at once.	what you pull in time	everything you did not
Terms change	The free tier is redefined against data already stored — a deadline, then deletion of the excess.	what fits the new cap	the oldest uploads first
Orderly exit	A real export is offered, and it works — for the image files only. This is the mode nobody plans for.	the pixels	tags, ratings, titles, albums
Provider bug	Code written for temporary storage is run against long-term storage during a migration.	the thumbnails	the full-resolution originals
Designed behaviour	Not a failure at all: inactivity and over-quota clocks delete on schedule, with the notice period buried in the terms.	what you log in to keep	what you forgot to visit

Four Numbers to Act On testable, not aspirational

2different media, not two drives — the word the popular version of the rule quietly loses
6–12 mobetween power-ups of a cold drive; run the integrity check then, so it stays one habit
5distinct ways a photo service fails you — only the first two of which an off-site copy fixes
2026the year an open, checksummed archival RAW format finally became an ISO standard

The Routine That Survives All Five six steps, once or twice a year

01Importoff the phone
02ConvertRAW to DNG
03Hashrecord on ingest
04Copy2 media, 1 away
05Verifyre-check, repair
06Printthe ones that matter

Recommendations settled first, contested last

Make one copy that sync cannot reach. A normally-unplugged drive, a versioned bucket, or an append-only target. The property is independence, not the count.
Record hashes, then re-check them. Monthly if the filesystem does it for you; otherwise stored hashes plus recovery blocks on the irreplaceable subset.
Never leave an SSD as the cold copy. Use a hard disk or optical, and verify at the same visit you power it up — one habit, not two.
Convert camera RAW to an open archival RAW. Documented, checksummed, library-recommended, ISO-standard since March 2026. Keep JPEG for delivery.
Organise in the filesystem, not only in an app. Year and occasion in folder names, descriptions in filenames or sidecars — the one part an exit cannot take.
Read every number here with its provenance. Cold hard-disk life is unpublished; disc and print figures come from vendor-adjacent testing. Act on the mechanism, not the year.

Where it lands

The usual advice survives device loss, service closure and quota expiry — and still loses photos to the failure its own readers describe. Add verification of content, judge every medium by min(medium life, reader availability), and migrate before the reader disappears rather than after. Then the closing promise — that they will last a lifetime too — becomes true rather than merely hopeful.