Backup disk security/encryption

Yes, drive-level encryption…

For efficiency, Borg dices files into chunks. Each chunk is hashed (effectively a fingerprint), and the hashes are compared to find duplicates. In a best case scenario, identical copies of files are only stored once in a Borg archive, but even files that aren’t identical can have matching chunks (e.g. two MP3 files of the same audio track – one with ID3 tags, one without – likely overlap by more than 99%).

Deduplication is great, but the downside is if an archive chunk is damaged/lost, it could impact multiple files. So Borg has built-in diagnostics and repair tools for backup integrity by verifying the hash for every chunk in an archive.

When a storage drive suffers media errors, if the archive chunks are wrapped inside drive-level encryption, it’d first require recovery of the encrypted filesystem blocks (at least enough to make the filesystem mountable). If the block size is 4096 bytes (a common size), an archive chunk is likely 1000x larger (IIRC, Borg’s default is 4 MiB), so one damaged filesystem block could take out a much bigger archive chunk, which in turn could nuke a bunch of archived files that share that archive chunk. Without drive-level encryption, recovery is much less complicated and more likely to be successful.

1 Like