Data sovereignty at your fingertips: Securing with Restic and tangible media

Data sovereignty at your fingertips: Securing with Restic and tangible media
By Matthias Petermann / on 08.11.2025

Why backups are more than routine

In a time when almost everything is stored digitally, data backup is no longer an afterthought - it is digital self-defense. Whether family photos, tax documents or your own development projects: The availability of this data determines memories, obligations and sometimes even existence.

Most people rely – consciously or unconsciously – on central cloud providers. But this entails several risks: technological, legal and psychological.

Clouds are convenient. But they shift responsibility. They suggest security, while at their core they only guarantee availability. This is not a backup.

⚠️ If it's just in the cloud, you don't really own it
Clouds provide service levels, not ownership. Your data is located on someone else’s infrastructure, under someone else’s jurisdiction and someone else’s terms and conditions.

Shared Responsibility: Responsibility with footnotes

The terms and conditions of almost all cloud platforms contain a similar passage:

“The customer is responsible for backing up and restoring their data.”

This is called the Shared Responsibility Model. The provider provides electricity, hardware and accessibility - everything else remains your responsibility.

This is understandable from the provider’s perspective: They have no way of knowing whether a file was deleted because you intentionally removed it or because an account was compromised. Therefore, backup remains your duty.

ℹ️ Shared responsibility in practice
Cloud providers guarantee the availability of their services - not the integrity or recoverability of your data. If your account is suspended, deleted or corrupted, their responsibility ends.

The physical boundary of the cloud

Even if you rely on cloud backup: How realistic is a full recovery over a normal internet connection?

Downloading a terabyte over a 50 Mbit line ideally takes over 2 days. Without failures, without throttling. This is not a backup strategy – this is a test of patience.

A physical backup, on the other hand, is tangible, quick and verifiable. You can pick up the hard drive, connect it, and restore it immediately.

⚡ The practical limit of management
Availability does not mean recoverability. A local backup remains the measure of all things – not out of nostalgia, but out of physical reason.

Restic: Tool for tangible security

Restic is an open source backup tool that started in 2015 with a simple idea: Backups should be simple, secure and verifiable – and work on any system.

Today Restic is a reference project for robust, decentralized data backup. It runs on Linux, macOS and Windows, requires no database, no cloud connection, no license keys.

ℹ️ Why Restic is technically convincing
  • Written in Go – compiled for all platforms with no dependencies.
  • Fully encrypted and deduplicated.
  • Stores backups as object-based repositories (similar to Git).
  • Works reliably on local media, via SSH, S3 or Rclone.

Official Sources:


How Restic works

Restic does not simply save the backup as a copy. It divides all data into small blocks (blobs), hashes them with SHA-256 and stores them encrypted. This means Restic detects duplicate data immediately and only saves it once.

This saves storage space and significantly speeds up incremental backups. Each backup is a complete “snapshot” of the data state, but without redundant copies of identical files.

💡 Snapshots instead of versions
Each snapshot can be restored independently - even if previous ones have been deleted. This is the opposite model to incremental chains, which become unusable if defects occur.

Cryptographic Architecture: Why Restic is Hard to Crack

Restic encrypts all content – ​​including metadata – using state-of-the-art cryptography:

  • AES-256 in Counter Mode (CTR) for data encryption
  • Poly1305 for message authentication
  • PBKDF2 (Password-Based Key Derivation Function 2) with high work factor for password derivation
  • Salted Key Derivation: each repository has its own randomly generated salt
  • HMAC-SHA256 for integrity checking of each saved object

This means: even if someone steals your data carrier, it only has random bytes - without a password there is no chance of decryption.

🔒 Cryptographic Resilience
Restic does not protect itself through secrecy, but rather through proven standards. Key derivation is so computationally intensive that brute force attacks are economically pointless. A simple password like “Treehouse!2025” becomes a highly complex key stream using PBKDF2.

The cost of a brute force attack is exponential: Each attempt costs energy and time - and the PBKDF2 iteration artificially slows down each candidate. Even if the hardware was accessed, a successful attack would be virtually impossible.


Restic in practice

A typical backup workflow on a Linux home server:

export RESTIC_REPOSITORY=/mnt/backup/restic_repo
export RESTIC_PASSWORD_FILE=/etc/restic_password.txt

restic init
restic backup /srv/data --tag homeserver
restic snapshots

Each run automatically creates a new snapshot. These snapshots can be compared, deleted or restored at any time:

restic restore latest --target /wiederhergestellt
📝 Password handling
The password file (/etc/restic_password.txt) should only exist on the server. It is not saved on the backup media itself. When restoring it is entered manually.

Media rotation and physical resilience

A backup is only as resilient as its carrier material. That’s why a rotating backup strategy is recommended - at least three disks, preferably more.

Duration Medium Location
Week 1 A Home (active)
Week 2 B with family/friends
Week 3 C outsourced (e.g. office, bank locker)

If there are four or five media items, a “long-term archive” can be added annually.

💡 Safe rotation
The more media, the lower the risk. A corrupted disk is not a problem if other generations exist.
⚠️ Quality of the data carriers
Cheap USB hard drives are deceptive: often “refurbished” or OEM leftovers with an increased error rate. Branded drives with documented MTBF (Mean Time Between Failures) and stable housing cooling are recommended. Check SMART values ​​regularly!

Media choice, bitrot and durability

Data ages – even without use. Magnetic hard drives can develop bad sectors after years, SSDs lose charge in flash cells.

That’s why: Backups are a process, not a state. A regular check run (restic check) detects damaged blobs at an early stage. This allows you to react before data is irretrievably lost.

🏗️ Long term strategy
  • Use different manufacturers and series.
  • Perform regular integrity checks with restic check.
  • Replace media as scheduled after 3-5 years.

exFAT: Easy interoperability

If different systems are involved - Linux, Windows, macOS - exFAT is a suitable file system. It is universally readable and writable, supports large files, and is natively supported by modern systems.

For data carriers that are regularly exchanged or transported, exFAT 2025 is the most practical option.

⚙️ Compatibility tip
exFAT combines simplicity with compatibility. Just make sure you unmount it cleanly (umount) to avoid data loss.

Automation on the home server

A cron job or systemd timer is often enough to run the backup automatically:

#!/bin/sh
DEVICE=$(/sbin/blkid -t PARTLABEL="backup" -o device)
MOUNTPOINT="/mnt/backup"

mount -t exfat $DEVICE $MOUNTPOINT
restic backup /srv/data --repo $MOUNTPOINT/restic_repo --password-file /etc/restic_password.txt --tag auto
umount $MOUNTPOINT
💡 Extensibility of the backup script
The script can be easily expanded - for example with simple media management, which automatically reinitializes the repository when a change in the backup medium (different media ID) is detected. A daily email report can also be added, which provides information about the success of the backup and clearly presents status details. Additional functions – such as rotation, automatic checks or integrity checks – can be added with little effort.

The human factor: understandability in an emergency

A backup is only as valuable as the ability to restore it. That’s why a small README file belongs on every data carrier:

NOTFALLPLAN

1. Backup-Festplatte anschließen.
2. Restic starten:
   ./restic restore latest --target /wiederhergestellt
3. Passwort eingeben.
4. Daten finden sich anschließend im Ordner /wiederhergestellt.

This step turns a technical backup into a family-compatible backup. In an emergency, no one has to improvise.

💡 Restic binary on the backup media
Restic is a small, standalone binary with no external dependencies. It has proven useful to store a copy of it - ideally for Linux and Windows - directly on the backup media next to the README. This way, in an emergency, you have everything you need with the data carrier, README and binary to restore the backup on almost any device.

Conclusion: Tangible backups as an expression of digital maturity

Clouds are convenient, but they are no substitute for responsibility. If you really want to own your data, you have to be able to physically secure it, encrypt it and verify it.

Restic symbolizes an attitude: Transparency, traceability and independence. A backup is not a hassle - it is proof of true digital sovereignty.

💡 Proof instead of PowerPoint
A backup is not a backup until you have tested restoring it. Before that it’s just a good feeling.