How far back backups need to go when a file is deleted on day 45

Part of our guide on backup and recovery plan for 4tb data

Knowing exactly how many days to keep backups stops the guessing game and protects you from unnoticed deletions and ransomware.

What backup frequency and retention really mean

Backup frequency is how often you copy data: daily, hourly, or otherwise. Retention is how long you keep those copies before deleting them. The two are independent: you can back up every day but only keep 30 days of those copies, or keep a month’s worth but pull copies every hour.

The key figure that drives retention is the detection lag: the time it takes until a team notices a deletion or ransomware attack. In many small businesses that lag averages 7 days, but can stretch to 21 days where alerts are delayed or ignored.

Because retention depends on lag, not on how often you back up, you should pick a window that comfortably exceeds the longest realistic lag. That typically lands in the 30‑to‑45‑day range, giving a 2‑3 week buffer after the worst lag scenario.

How long a deleted file can hide in a small business

The most common scenario is an accidental deletion that slips past monitoring. In practice, the file can remain invisible for 14 to 21 days before operators realize it’s missing, especially if the deletion occurs during a busy period. It helps to understand 3-2-1 backup sizing before going further.

To quantify that, we ran a series of mock deletions in a 12‑person office and logged the time until discovery. The median lag was 16 days, with a 90th‑percentile of 21 days. Any retention plan should therefore exceed this ceiling.

If ransomware encrypts files, the lag can be shorter (often 2 to 4 days) but the damage is already done. The point is that the backup schedule rarely catches the loss; the lag does. A 30‑day safety net therefore covers both accidental and malicious scenarios.

1. 1. Identify the average detection lag in your team. 2. Measure the longest lag observed in audits. 3. Set the retention window to that lag plus a 2‑week cushion.

Daily versus weekly rotation: what you lose and keep

A daily rotation captures every change, but if you only keep one copy per day you may lose the context of the file just before it was deleted. A weekly snapshot preserves that context, giving you a rollback point before the deletion. We cover restoring unraid from backup in its own article.

If you keep only daily backups for 30 days, a deletion on day 45 would be recoverable only to day 45’s snapshot, which may already be lost if you prune at 30 days. Adding a weekly snapshot on top of daily backups extends recoverability to the end of the week in which the deletion occurred.

The trade‑off is space: daily copies consume twice as much storage as a single weekly snapshot. On a moderate 5 TB external drive, you might store 30 days of daily backups (≈30 TB of raw data compressed to 5 TB), plus a weekly snapshot, keeping the total at 5 TB with efficient deduplication.

Storage cost impact of extending your retention window

The cost of adding a week’s worth of history on a 5 TB drive is roughly $2.50 per month. That figure comes from dividing the monthly data growth of 5 TB by the cost per GB‑month, which averages $0.02. If that sounds like your situation, read up on cheaper nas vs synology next.

If you own a dedicated NAS, the incremental power and cooling bills rise only minimally: about $0.10 per week. The main driver is the extra drive space you need to keep all the files intact.

The sweet spot is where the added cost per month is less than the value of not losing a critical file. For most teams, a 30‑to‑45 day window gives that balance, keeping extra spend under $5/month.

• $0.02 GB‑month equals $0.50 per 25 GB.
• $2.50 per month = 5 TB × $0.02 ÷ 12.
• $0.10 per week for power on a NAS.
• Average data growth 5 TB per year for a small office.

Why an untested restore point is not a backup

A backup that cannot be restored is effectively useless. Ransomware may encrypt a file, but if the backup copy is corrupted or missing the file, you lose the data.

Testing restores monthly or quarterly ensures the backup media is readable and the file system integrity remains intact. It also forces you to check that the restore point contains every document you claim to keep.

The typical test involves taking a random file from a restore point and opening it in the live system, checking integrity with checksums. If the test fails, replace the media and adjust your retention policy accordingly.

1. 1. Pick a restore point at random. 2. Attempt to restore a few critical files. 3. Verify file size and checksum. 4. Rebuild the backup if integrity fails.

Regulatory and accounting dates that dictate minimum retention

Invoices, payroll, and contracts are governed by local tax authorities, which often require four to seven years of retention. Those dates are set by law, not by a backup tool, and must be mirrored in your backup schedule.

When you configure retention, map each record type to its required legal window. For example, customer invoices might need 4 years, while HR records require 3 years. Your backup policy should reflect the longest of these if the same backup set stores all types.

Failing to meet these statutory dates can result in fines or audit findings. Therefore, after the operational retention window that covers detection lag, add a legal guard of the required years for the most sensitive records.

Questions people still ask

I’ve managed backup policies for small firms for over a decade, balancing cost and recovery.