Choosing backup storage: local disk, NAS, S3-compatible storage, tape and cloud compared

By Lucas Flores, IT Systeme Flores UG. Last updated 2026-10-16

What should you compare?

• Cost. The price per terabyte is only part of it. Add the hardware you replace, the power and the time you spend, or, for a service, the minimum storage durations, retrieval and traffic charges and the cost of leaving.
• Durability. How the storage protects against losing data on its own: redundancy within a device or across a provider's sites. It is a different thing from a second copy.
• Immutability. Whether the storage itself can refuse to change or delete data until a date, which protects a copy even if the backup software or its credentials are taken over. See immutable backups, WORM and air gaps.
• Restore speed. The slowest link between the storage and the place you restore to, plus any waiting before the first byte. It sets your recovery time objective.
• Failure domain. What fails together with the primary: the building, the account, the administrator credentials. The 3-2-1 rule is about this.

How do the options compare?

How do these options fit together?

Two common combinations for a small business follow the 3-2-1 rule. The first is a local disk or NAS for fast restores plus object storage at a provider as the offsite copy, with the offsite copy locked where the provider allows it. The second adds an offline copy, either rotated disks or tape, for the case in which every online copy is reached by an attacker. The US-CERT paper on backup options makes the same point from the other direction: putting primary data and its backup on one internal disk means that one failure takes both, and a rolling backup can silently copy corruption or malware across.

CISA warns that most ransomware actors look for accessible backups to delete or encrypt, and that a cloud backup that only syncs files can carry encrypted files into the cloud. A NAS share that stays mounted and a bucket reachable with the backup server's keys are accessible in exactly that sense. Separate credentials and a lock on at least one copy reduce what an intruder with the backup server's access can reach.

What does durability mean, and what does it not?

The 99.999999999 percent figure ("eleven nines") that AWS gives for its S3 classes is a design target for the service not losing the objects you store. It does not cover you deleting them, a leaked access key, a corrupted source that was backed up, or an account that is closed, and it is not availability: AWS gives a separate design figure of 99.99 percent availability for S3 Standard and a 99.9 percent service-level commitment. Durability inside one provider is also not a second copy.

What does the price per terabyte leave out?

• Restoring. Some services include a traffic allowance. Hetzner Object Storage, for example, includes about 1 TB of traffic in its base price and bills more per terabyte, while uploads and S3 operations are free. Others bill per gigabyte for downloads. A restore of your full data set is the traffic you should budget for.
• Leaving. The EU Data Act ends switching charges, egress charges included, from 12 January 2027. The European Commission's explanation covers switching between providers; it says nothing about ordinary download fees, so read your contract for those.
• Minimums. Archive tiers charge for a minimum storage duration even if you delete earlier. Hetzner bills objects below 64 kB as 64 kB, which matters for tools that write many small objects; a backup format that bundles data into large files avoids that.
• A lock that is too long. You pay for what you cannot delete. Test a lock period with a small amount of data first.
• Your own time. Disks and tapes need replacing, checking and rotating.

How Restow handles this

Restow writes backups to a repository, which is a storage target with a role. There is no Restow-run cloud; your storage bill is your storage bill. See also why bring-your-own-storage matters.

What a repository can be

• A local path. The default target is a local disk on a Docker volume inside the same container, so Restow runs self-contained. A directory path on the server is possible too; adding a local filesystem path needs a provider admin.
• S3-compatible object storage, with a preset for Hetzner Object Storage that has a location choice (Falkenstein, Nuremberg, Helsinki). The storage documentation also names AWS S3, Wasabi, Backblaze B2 and Garage as S3-compatible targets. An S3 endpoint has to use HTTPS: since 0.4.0 a new or changed endpoint over plain http is refused, except to the machine itself. Restow detects whether a bucket enforces Object Lock and shows it, and since 0.4.0 it can lock backup data in such a bucket per repository (compliance or governance mode, 1 to 3650 days). Object Lock has to be enabled when the bucket is created.
• NFS, through an opt-in mounter container. A share is added from the web interface under Installation, Network shares, or by typing an NFS address such as nas.local:/volume1/restow into the path field of a directory repository. NFS is the only network protocol for storage; SMB is not a storage target. An SMB share or NFS export is something Restow backs up, not somewhere it stores to; see file shares (SMB and NFS). A directory repository gets only a deletion delay that Restow enforces itself, which is not immutability.
• A copy repository. A tenant has one primary repository, which receives every new backup first, and any number of copies that receive the same data. Older data is mirrored onto a new copy and verified by SHA-256 during the weekly storage check, and a copy can later be promoted to primary once it is proven complete. A copy covers mail, calendar, contacts, OneDrive, SharePoint, IMAP and Proxmox VE VM data; servers, clients, file shares and Proxmox VE containers stay in the primary repository. Each repository, copies included, has its own immutability setting. Moving the primary to new storage copies and verifies everything before the switch, and the old location stays readable until you remove it.

What was tested and what was not

• The automated checks run S3 against Garage. The Hetzner preset has not been tested against a real Hetzner bucket, and nor has the Object Lock detection there.
• Mounting an NFS share from the web interface was tested against stand-ins, not against a real NFS server.
• Restow has no tape target. An SFTP target is planned without a date.
• Immutable backups were tested against a simulated S3 service with Object Lock, not yet against a real one, and we have not tested Restow against a bucket with a default Object Lock retention. The installation's default repository cannot be made immutable; give the tenant a repository of its own. See immutable backups, WORM and air gaps and the storage page.

Limits to plan around

Jobs write to the tenant's primary repository; a job cannot choose another one. While server or client repositories exist, Restow refuses to change the primary, because the migration copies only the organisation's own data; revoke or uninstall the machines first. The restic repositories of servers, clients, file shares and Proxmox VE containers live on the primary repository only. See storage for the full list.

Frequently asked questions

Sources

Read on 16 October 2026.

1. Ruggiero, P. and Heckathorn, M.: Data Backup Options (US-CERT, Carnegie Mellon University, 2012). Pros, cons and security of internal disks, removable media, tape and cloud storage
2. Amazon S3 storage classes. Design durability and availability, retrieval times of the archive tiers, minimum storage durations
3. Amazon S3 User Guide: Locking objects with Object Lock. Write-once-read-many locking of object versions; versioning is required
4. Hetzner Docs: Object Storage overview. An S3-compatible service as an example of the pricing model: base price with included storage and traffic, free ingress and operations, 64 kB minimum object size
5. Hetzner Docs: Object Lock, Retention. Object Lock has to be enabled when the bucket is created
6. LTO Program: LTO-10. 30 and 40 TB native capacity, native transfer rate, WORM and hardware encryption
7. LTO Program: Benefits of LTO. WORM from LTO-3, hardware encryption from LTO-4, tapes taken offline
8. Proxmox Backup Server documentation: Tape Backup. Tape adds a copy on different media that can be moved offsite; restores are much slower than from disk because tape has no random access
9. European Commission: Data Act explained. Switching charges, egress charges included, end on 12 January 2027
10. CISA: #StopRansomware Guide, version 3.0 (October 2023). Ransomware actors try to find and delete or encrypt accessible backups; sync is not backup

Related articles

• The 3-2-1 backup rule Three copies, two kinds of storage, one location apart, and the extension with an immutable copy and zero errors. With a worked Microsoft 365 example.
• Immutable backups, WORM and air gaps How attackers go after backups, what Object Lock in governance and compliance mode does, what an offline copy adds, and what none of it covers.
• RPO and RTO explained The two recovery objectives as NIST and SNIA define them, how backup frequency and restore paths set them, a worked example and a small calculator.
• Full, incremental, differential and synthetic full A comparison table for storage use, backup time, restore effort and chain risk, plus forever-incremental, changed block tracking and deduplication.
• Backup glossary reference Short definitions of backup, restore and retention terms, from 3-2-1 rule to WORM, with links to the articles and features pages that go deeper.