Towers of Hanoi in backup: a rotation scheme that reaches far into the past with few media. Backup media, whether tapes, hard drives or cloud snapshots, cost money and storage space. Anyone who wants to look back as far as possible with few media sooner or later ends up with the Hanoi rotation scheme, one of the oldest and most thought-out methods of classic tape backup. We explain how it works, where it is superior to the simpler FIFO principle and for whom the extra effort is worthwhile.
Where the name comes from
The namesake is the logic puzzle "Towers of Hanoi" (published in 1883 by the French mathematician Édouard Lucas): three rods, several discs of different sizes that must be moved from one rod to another according to fixed rules, a larger disc never being placed on a smaller one. The special thing about the solution: some discs are moved with every move, others only every few, still others only every very many moves; the frequency of movement halves from disc to disc. Exactly this pattern, a few media used very often, others very rarely, was transferred to tape rotation, creating a rotation scheme that covers an unusually long period with few media.
The principle: exponentially staggered retention times
Instead of using all media equally often as with FIFO, in the Hanoi scheme each medium gets its own level with its own frequency of use. Medium A is written every second day, medium B only every fourth, medium C every eighth, medium D every sixteenth, and so on. Each further level doubles the interval to the previous one. With only five media (A to E) you already cover a rotation cycle of 16 days; with FIFO you would need 16 individual media for the same period. In general n media suffice for 2n−1 days. The last medium (here E) is written alternately on day 16, 32, 48 and so on and each time replaces the state from 16 days earlier.
The practical effect: for the most recent past many, closely spaced recovery points are available, for periods further back, by contrast, few but existing backups. So you do not lose a complete history, only its resolution: a data state from a good two weeks ago can still be reconstructed, just no longer to the day.
An example from practice
Five tapes, A to E, one backup per day (backup day 1, 2, 3 and so on). The sequence follows from the rule: tape A on all odd days, B on day 2, 6, 10, 14, C on day 4 and 12, D on day 8, E on day 16 (then again from the start). Over 16 days this gives this order: A, B, A, C, A, B, A, D, A, B, A, C, A, B, A, E.
| Medium | Written on backup day | Interval |
|---|---|---|
| A | 1, 3, 5, 7, 9, 11, 13, 15 ... | every 2nd day |
| B | 2, 6, 10, 14 ... | every 4th day |
| C | 4, 12, 20 ... | every 8th day |
| D | 8, 24, 40 ... | every 16th day |
| E | 16, 32, 48 ... | every 16th day (last medium) |
After the backup on day 16 the tapes hold the states of day 16 (E), 15 (A), 14 (B), 12 (C) and 8 (D). So you can go back to the state of today, yesterday, the day before yesterday, four and eight days ago. If on day 16 you notice that a file was already damaged on day 10, the state on tape A does not help, but tape D (day 8) does. The further back, the coarser the resolution. If a problem is only discovered after more than 16 days, this five-medium scheme no longer reaches back; for that you need further levels (each additional level doubles the look-back).
Advantages over FIFO
The decisive advantage is the long look-back horizon with manageable media needs. Especially with ransomware attacks with a long dwell time in the network, often weeks before the actual encryption starts, this considerably increases the chance of still having an undamaged, old generation. Even errors that are noticed late, for example a creeping faulty data migration, can often still be repaired with the older, coarser states.
Disadvantages: more complexity, uneven wear
The price for the long look-back is administrative effort. Without automated backup software, assigning which medium is due when is error-prone by hand, a swapped tape immediately blows up the whole scheme. With physical tapes or hard drives uneven wear is added: the medium of the first level is written many times more often than that of the last level and wears out correspondingly faster, an aspect many businesses overlook when replacing media. And a restore from a very old generation naturally brings only a coarse time resolution; for the exact version from three weeks ago there is usually only a single possible state, not several.
FIFO and Hanoi compared
| Criterion | FIFO | Hanoi scheme |
|---|---|---|
| Look-back horizon | Short, directly tied to number of media | Long, grows exponentially with each level |
| Media needs | One medium per look-back day | Few media for long periods (n media for 2n−1 days) |
| Administrative effort | Very low, easy to understand | Higher, best automated |
| Media wear | Evenly distributed across all media | Uneven, lowest level used much more heavily |
| Ransomware resilience | Low with a long attack dwell time | Considerably higher due to old, untouched generations |
For whom is the effort worthwhile?
The Hanoi scheme is worthwhile above all where data loss becomes expensive and a purely short-term look-back is not enough: businesses with compliance or audit requirements, companies that have already been the target of an attack or manage a particularly sensitive customer database, and generally anywhere a late-discovered compromise weighs more heavily economically than the additional administrative effort. For a very small business with uncritical data that is overwritten daily anyway, the effort is often not justified; a simpler scheme such as FIFO is usually enough there, combined with an additional external copy following the 3-2-1 rule.
Modern backup software makes it easier
Good news for everyone who shrinks from manual administration: modern backup solutions such as Veeam or Synology Active Backup map generation principles such as Hanoi or the related, somewhat simplified GFS rotation (grandfather-father-son, with fixed daily, weekly and monthly levels) automatically. The exponential staggering runs in the background without anyone having to assign media by hand; the principle remains the same, but the administrative effort drops to a minimum.
Conclusion
The Hanoi rotation scheme trades somewhat more complexity for a considerably longer, staggered look-back, and that is exactly what makes it one of the most effective lines of defence against ransomware with a long dwell time in the network. solutioIT sets up automated backup concepts with a suitable rotation scheme for businesses in the Westerwald, from simple FIFO rotation to the staggered generation principle, as part of our server and network support.