Digital Preservation · Hardware · Platform Risk · Research BriefPersonal archives · record current to September 2026
Four failure modes, not one
What Actually Threatens a Digital Photo Archive
A digital photograph survives only where four separate things hold at once: the medium it sits on, the bytes it is made of, the format it is written in, and the company running the service that stores it. Each fails in its own way, on its own timeline, and a backup copy does not defend against all four.
What Happened
Four things had to go wrong, and each one did, somewhere, on the record Graded by how firmly each is established, not by when it happened.
- 1 in 1,500files found silently corrupted in an ~8.7 TB CERN audit, 2007
- 99.8%chance one flipped bit made a compressed file unreadable, CERN 2007
- 1.36%annualised hard-drive failure rate across Backblaze’s fleet, 2025
- 15 GBshared free quota new Google Photos uploads now count against
What is established, and how firmly Sorted by standing; the grades are never mixed within a row.
| Standing | What the record shows | Source |
|---|---|---|
| Confirmed | CERN’s 2007 internal audit of about 8.7 TB of production data found 22 corrupted files among 33,700 checked — a rate of one bad file in 1,500 — and that a single flipped bit made a compressed file unreadable with 99.8% probability. | CERN, 2007 |
| Confirmed | Backblaze’s monitored fleet of 344,196 hard drives posted an annualised failure rate of 1.36% in 2025, down from 1.55% in 2024. | Backblaze, Feb 2026 |
| Confirmed | Google ended unlimited free storage for photos and videos uploaded in High quality; from 1 June 2021 new uploads of that kind count against the shared 15 GB free Google Account quota. | Google, Nov 2020 |
| Confirmed | Code42 discontinued CrashPlan for Home, its consumer backup product, giving existing customers roughly fourteen months to move their data before the service closed to them. | TechCrunch, Aug 2017 |
| Confirmed | The National Digital Stewardship Alliance released Version 2.1 of its Levels of Digital Preservation framework, adding guidance on environmental sustainability. | NDSA, Mar 2026 |
| Confirmed | SoftMaker published practical backup advice for personal photo collections, including the 3-2-1 rule. | SoftMaker, Aug 2026 |
| Confirmed but not verifiable here | Code42’s Incydr Backup Add-on stopped taking new orders on 1 January 2026 and is scheduled to reach end of life on 31 December 2026, after which archived backups are deleted. | Code42, via Backblaze, Sep 2026 |
| Unconfirmed | Beyond the cases named above, cloud and photo-storage providers in general have “closed up shop, changed their terms or scrapped their free offerings” over roughly the past decade and a half — a claim made without further names or dates. | SoftMaker, Aug 2026 |
Timeline
Two decades of the same four kinds of failure Dated as each source dates itself.
- 2007CERN completes an internal study finding that silent data corruption is real and measurable in production storage, and that a single bit error makes a compressed file unreadable with 99.8% probability.
- 2017Code42 discontinues CrashPlan for Home, telling customers to migrate before the consumer service closes; Backblaze and Carbonite are named as the obvious alternatives.
- 2020Google announces it will end unlimited free “High quality” storage for Google Photos, effective the following June.
- 2021The Google Photos change takes effect: only photos and videos uploaded in High quality before 1 June remain exempt from the shared 15 GB free quota.
- 2022Code42 spins its backup business off to Mill Point Capital as the independent CrashPlan Group; Code42 keeps its Incydr product line and is later folded into Mimecast.
- Mar 2026The National Digital Stewardship Alliance releases Version 2.1 of its Levels of Digital Preservation framework, adding an environmental-sustainability lens.
- 14 Aug 2026SoftMaker publishes practical backup advice for personal photo collections, including the 3-2-1 rule — three copies, on two kinds of media, one kept off-site.
- 1 Jan–31 Dec 2026Code42’s Incydr Backup Add-on stops accepting new orders on 1 January and reaches end of life on 31 December, after which archived backups are deleted.
- 1 Sep 2026Backblaze publishes an account of the Code42/CrashPlan situation for IT buyers weighing a replacement, noting that CrashPlan and Code42 have been separate companies since 2022.
Not everything here carries a day. The Library of Congress’s format descriptions for JPEG and for Adobe’s DNG specification show only a “last updated” date on the page — 8 May 2024 and 12 March 2025 respectively — not when the underlying research was first written. The Levels of Digital Preservation framework names only the month of its 2.1 release, March 2026. And JEDEC’s own retention specification for solid-state drives could not be opened at all: every address tried at jedec.org returned a bot-detection block, not a page.
The Argument
Four points of failure, each independent of the other three Attributed to the sources that carry it, by name.
None of the four failure modes below is hypothetical, and none is solved by the others. A copy on a second drive does nothing if the drive’s own cells have quietly forgotten their charge. A check that catches corruption does nothing if the file format it protects stops being readable in ten years. And a company can keep every promise about redundancy and disclosure and still decide, for its own commercial reasons, to end the product.
The medium itself has a rated life, and it is shorter unpowered than most people assume. IBM’s own support guidance describes JEDEC’s requirement for enterprise solid-state drives plainly: a drive at the end of its rated service life must still hold its data for a minimum of three months at 40°C, which is why IBM tells customers to power a shut-down system on for two weeks after every two months off. Storage vendor Starline puts rough figures on the same effect by memory-cell type — roughly ten years for the oldest single-bit-per-cell chips, falling toward three years for the triple-bit cells common in consumer drives today — and warns that, in the worst case, a heavily used drive can start losing data in as little as four months. None of this is a defect; it is what the technology is rated to do, whether the drive sits in a drawer or the back of a closet.
Even a powered, working drive can quietly return the wrong bytes, and neither a copy nor a sync catches this on its own. In the 2007 CERN study, engineers checked 33,700 files (about 8.7 TB) against their recorded checksums and found 22 mismatches — a rate of one bad file in 1,500. The more consequential finding sits beside it: for a compressed file, a single flipped bit made the whole file unreadable 99.8% of the time in their tests. A photograph saved as a JPEG is compressed by default, which is exactly the case the finding describes. The two filesystems built to catch this, OpenZFS and Btrfs, checksum every block on write and verify it again on read, and OpenZFS can repair a bad block automatically where redundancy exists — but neither ships as the default on a phone, an off-the-shelf external drive, or a consumer cloud photo service, so most personal photo storage has no equivalent check running at all.
A file also has to remain legible to some piece of software, which is a separate question from whether its bytes are intact. The Library of Congress grades formats on seven factors — disclosure, adoption, transparency, self-documentation, external dependencies, patents and technical protection — and by that standard JPEG (ISO/IEC 10918-1, confirmed current in 2017) is “fully disclosed” and “very widely adopted”; two patent disputes over JPEG encoding were both resolved without encumbering the format. A camera’s native RAW file is a different case: most manufacturers publish no equivalent specification for their own RAW format, which is why Adobe’s openly published Digital Negative (DNG) specification — version 1.6.0.0, December 2021, with a public patent licence — exists as an archival option a photographer can convert into.
The provider running the service is a fourth, independent point of failure, and it needs no error and no malice to remove your access — a business decision is enough. Google changed the terms of its free photo storage in 2020. Code42 discontinued its consumer backup product in 2017 and is winding down a separate enterprise backup add-on through 2026, after which the archived backups it held are deleted. SoftMaker’s own advice post names this risk in general terms, warning that a provider can “shut services down, change their terms or scrap their free offerings” — a claim these three dated cases make concrete.
What Others Add
The depth behind each of the four points Mechanism, standards and a professional framework, from outside the two backup-advice posts.
Format governance
Disclosure is what makes a format outlive its own decade
- JPEG (ISO/IEC 10918-1) was reviewed and reconfirmed current in 2017, and is graded “fully disclosed” and “very widely adopted”.
- Two patent disputes over JPEG encoding (Forgent Networks, 2002–2006; Global Patent Holdings, 2007–2009) were both resolved against the claimants.
- Adobe’s DNG specification (v1.6.0.0, Dec 2021) is graded “fully documented”, with a public patent licence Adobe grants to any implementer, and is used in Apple ProRAW.
Checking the bytes, not just copying them
Two open filesystems checksum every block by default
- OpenZFS calculates a checksum for every block on write and verifies it again on read, repairing a bad block automatically where a mirror or RAID copy exists.
- OpenZFS’s periodic scrub reads the whole storage pool on a schedule specifically to catch latent bit rot before a reader needs the damaged file.
- Btrfs checksums data and metadata by default too, defaulting to CRC32C with XXHASH, SHA-256 or BLAKE2b available for stronger protection.
- Neither ships by default on a phone, an off-the-shelf external drive, or a consumer cloud photo service.
What actually limits an unpowered drive
Retention is rated, and it gets worse with wear and heat
- IBM: JEDEC’s enterprise-SSD spec requires 3 months’ retention at 40°C once a drive is at the end of its rated service life; IBM recommends powering a shut-down system on for two weeks every two months.
- Starline: rough retention by NAND type — roughly ten years for SLC, falling toward three years for the TLC cells common in consumer drives; worst case, as little as four months at 40°C, end-of-life.
- JEDEC’s own specification document (JESD218) could not be opened at any address tried; these are vendors describing what the standard requires, not the standard itself.
A staged approach, not a single checklist item
Preservation is treated as a maturity ladder, not a yes/no
- The Levels of Digital Preservation framework, first published in 2013, reached Version 2.0 in 2019 and Version 2.1 in March 2026.
- The 2.1 revision adds guidance on weighing environmental sustainability against preservation decisions, without changing the underlying levels.
- The framework’s own detailed matrix is hosted on a JavaScript-rendered site and could not be read directly, so its specific staged criteria are not reproduced here.
Conclusion
None of the four defences substitutes for another What to do about each, and what to still hold loosely.
- Spread copies across more than one kind of medium and more than one vendor, not just more than one drive — a manufacturing or firmware fault can hit every unit of the same model at once.
- Check the copies, not just their existence: open a handful of files from each backup on a schedule, because a corrupted file usually gives no warning until it is opened.
- Where the storage is under your own control — a home NAS, for example — a filesystem that checksums on write and scrubs on a schedule (OpenZFS, Btrfs) catches corruption a plain copy never would.
- Keep at least one copy in an openly published, widely supported format — JPEG for a finished photo, DNG rather than a camera’s proprietary RAW for the original — since a format nobody but one company can read is a second way to lose a file that never touches the bytes at all.
- Do not let any one provider be the only place a copy exists, and read what a service actually promises before relying on its free tier — a free allowance can shrink, and a company can be sold, spun off or wound down.
What to hold loosely
The 2007 CERN figures describe one research computing centre’s infrastructure from that period; no comparably detailed successor study at that scale was found, so treat the exact rates as an illustration that silent corruption is real and compression raises its cost, not as a current number for any specific device. The Code42 Incydr timeline is corroborated rather than independently verified at its own source, which returned a block on every attempt to open it.
A photo needs four things to keep going right, not one
Working media, checked bytes, a readable format and a provider that is still there next year are four separate conditions, each with its own history of failing. Meeting all four is not automatic, and it is not exotic either — it is a handful of specific, checkable choices, repeated.