Grandfather-father-son (GFS) backup rotation, explained

By Lucas Flores, IT Systeme Flores UG. Last updated 2026-10-16

What do grandfather, father and son mean?

GFS names three generations of backups. The sons are the newest backups, taken every day. The fathers are a weekly backup that is kept longer. The grandfathers are a monthly backup that is kept longest. Many tools add a fourth level, yearly. When a new son arrives the oldest son is dropped, but the fathers and grandfathers stay.

The point is that age buys coarser steps. Yesterday and last Tuesday are both within reach, but for last spring you may only have the one from the end of the month.

What does a GFS calendar look like?

Here is one example policy, written as counts: keep 7 daily, 4 weekly, 12 monthly and 3 yearly restore points. The counts are an example, not a recommendation, and there is no standard set of numbers. The calendar assumes a nightly backup, weekly restore points on Sundays, monthly ones on the last day of the month and yearly ones on 31 December, and it shows what is kept on Thursday 15 October 2026.

That is 26 slots, but 11 October and 31 December 2025 each fill two of them, so 24 distinct restore points cover the last 7 days in daily steps, the last 4 weeks in weekly steps, the last 12 months in monthly steps and the last 3 years in yearly steps. Each night the oldest daily point falls out of the policy, each Sunday the oldest weekly one, and each month-end the oldest monthly one.

Example only. 26 dots are drawn; two restore points fill two roles, so 24 are stored.

How is GFS different from simple N-day retention?

Simple retention keeps every restore point for N days and then deletes it. GFS keeps fewer restore points, for longer. Compared with keeping every nightly backup for 30 days:

N-day retention is easier to explain and puts every night within reach. GFS is a trade: you give up fine steps in the past to reach further back. Which one fits depends on how late you expect to notice a problem and on what a contract or a compliance rule requires you to be able to show later. Backup retention and archive retention are separate questions; see backup vs. archive. Retention also decides how long erased personal data can still be found in your backups; see GDPR and backups.

Where does GFS come from, and how does it map to disk and object storage?

GFS is a media rotation scheme from the tape era: each generation was a set of physical tapes that was reused on a cycle, and the rotation told the operator which tape to load next. Vendor documentation still describes it as a tape rotation scheme. For a five-day work week, Arcserve's documentation counts four daily tapes, five weekly tapes and twelve monthly tapes, about 21 tapes for a year. Acronis documents the scheme with its own example settings: daily incremental backups kept for two weeks, weekly differential backups kept for two months and monthly full backups kept for a year. Neither source dates the scheme, so this page does not either.

On disk and object storage the same idea maps like this:

• Reusing tapes becomes pruning restore points. There is no media to rotate. A retention rule marks the restore points to keep and removes the rest.
• Weekly and monthly full backups become labels. On tape those sets were full backups because each set had to stand alone. With deduplication and synthetic full backups (see full, incremental, differential and synthetic full backups compared) a kept restore point can stand alone without reading the source again.
• The cost is storage, not tapes. Keeping an old restore point costs only the data that no other restore point shares, which with deduplication is often far less than a full copy.
• Taking tapes off site becomes a second location. A copy repository or replication to another site does that job; see the 3-2-1 rule.

How Restow handles this

Restow keeps restore points by a retention rule, and the rule depends on what you back up. This is exactly what is true today.

Servers and clients, file shares and Proxmox VE guests: daily, weekly and monthly counts

A backup job for machines sets how many daily, weekly and monthly restore points to keep. The default is 30 daily, 12 weekly and 12 monthly, and the limits are 3,650 daily, 520 weekly and 240 monthly. Retention runs on the Restow server, never on the machine, so a compromised machine cannot shorten it. There is no yearly level; a long monthly count covers that, since 240 monthly points reach back 20 years. File share jobs use the same three counts with the same defaults, applied as restic's keep rule just like for machines. Proxmox VE jobs (a preview, in every edition) use the same three counts, with defaults of 7 daily, 4 weekly and 6 monthly.

Mail and Microsoft 365 jobs: age tiers

Jobs for Exchange Online, OneDrive, SharePoint sites and IMAP do not use daily, weekly and monthly counts. They use a retention policy made of age tiers: each tier covers an age range and either keeps every restore point or keeps one per N days. The recommended policy keeps every restore point for 30 days, then one per day until 90 days, then one per week until one year, and nothing older. The other presets keep every restore point for 30 days, 90 days, 1 year, 3 years or 7 years, or keep everything without a limit, and a custom policy lets you build your own tiers. A policy can be the tenant default or apply to chosen objects, and a job names the policy it uses. Without a policy, every restore point is kept.

That is GFS-like thinning, written in days instead of named generations. The windows are fixed N-day windows, not calendar months, so "one per 30 days" is not "one per calendar month", and a yearly level is a tier you add yourself (one per 365 days). The newest restore point of every object and its newest checked one are never removed, restore points under a legal hold or a retention hold stay, and the retention page previews what the next run would remove before you save a policy.

Locks and holds change when a restore point leaves, not which ones the rule keeps

Two features can keep a restore point after the rule would drop it. With immutable backups turned on for a repository, a restore point is locked for the lock period plus seven days after it was written. Retention treats a deletion that the storage refuses as "not yet": the restore point stays visible and restorable, and its space comes back only after the lock has run out. So a daily restore point that falls out of a 30-day rule stays until its lock ends if the lock period is longer. A daily job also renews the lock of everything newer restore points still use, so a monthly restore point that shares data with recent ones keeps that data locked. The rule is unchanged; only the moment of deletion moves.

A retention hold, which comes with ransomware detection, pauses retention for an object while it has a suspicious restore point that nobody has resolved: no restore point of that object is deleted, so clean older restore points are not thinned out while encrypted ones pile up. Backups go on and storage grows. Only an administrator ends a hold, by marking the finding a false alarm or releasing the hold, and then the next retention run applies the rule again.

One more thing that is true

A restore point in Restow is complete in what it lists, so retention can remove any one of them without breaking the others; the storage check's garbage collection later removes the chunks that no restore point needs, and on immutable storage only once their lock has run out. The archive has retention rules of its own (enforced retention is part of Business and Service Provider), separate from backup restore points. Restow does not rotate media and has no tape support. See server and client backup, file shares (SMB and NFS), Microsoft 365 and IMAP backup and Proxmox VE backup.

Frequently asked questions

Sources

Read on 16 October 2026.

1. Arcserve Backup documentation: How GFS rotations work. Daily, weekly and monthly tape sets, and the tape count for a five-day schedule
2. Acronis Backup documentation: Using the Grandfather-Father-Son tape rotation scheme. GFS as a tape rotation scheme, with example settings for the three sets

Related articles

• Full, incremental, differential and synthetic full A comparison table for storage use, backup time, restore effort and chain risk, plus forever-incremental, changed block tracking and deduplication.
• The 3-2-1 backup rule Three copies, two kinds of storage, one location apart, and the extension with an immutable copy and zero errors. With a worked Microsoft 365 example.
• Does Microsoft 365 back up your data? What Microsoft keeps, for how long (recycle bins, version history, retention), why retention is not a backup, and what Microsoft 365 Backup is.
• RPO and RTO explained The two recovery objectives as NIST and SNIA define them, how backup frequency and restore paths set them, a worked example and a small calculator.
• GDPR and backups What Article 17 asks of a backup, what the EDPB and German authorities say, why backups usually expire, and where locks and holds collide with an erasure request. Not legal advice.
• Backup glossary reference Short definitions of backup, restore and retention terms, from 3-2-1 rule to WORM, with links to the articles and features pages that go deeper.