A NAS is not a backup. This is the most widespread and most costly confusion: because a NAS with RAID tolerates the failure of one disk, people believe it is safe from everything. Yet RAID protects the hardware, not the data. It will save you neither from a deletion, nor from ransomware, nor from a fire, nor from a corruption that spreads. For that, you need a separate, disconnected copy, stored elsewhere.

What follows explains what a NAS really is, what it protects against and what it does not, and why even two synchronised NAS units are not enough.

What is a NAS

A NAS (Network Attached Storage) is an enclosure that makes storage space available on the computer network, accessible through shares. In a company, several computers can thus place their files in the same location and share them among colleagues, each working on common documents.

To provide this service, a NAS carries a genuine software layer, with its own operating system. It is this that manages the network shares, often using the SMB protocol, but also the user groups, the passwords and the access rights. This intelligence comes at a cost: a NAS is not the fastest storage device there is. It depends on the network that links it to the workstations, and on its own software part.

One point deserves clarification: a NAS does not necessarily have RAID. RAID is a redundant system that tolerates the failure of one disk, in RAID 5, or of two disks, in RAID 6. Many NAS units carry at least two disks, sometimes up to sixteen or twenty-four, and then offer hardware security. Remember this word well: hardware. That is the whole point.

NAS or SAN: the nuance

People often confuse the NAS with another system, the SAN (Storage Area Network). The difference lies in the mode of connection. Where the NAS plugs into the classic Ethernet network, the SAN goes through a high-throughput storage network, using iSCSI or fibre optics, for example.

To put it simply, it is as if disk management had been moved outside the computer's enclosure: with a SAN, the disk blocks appear as local disks, and access to the physical medium is more direct than with a NAS. The NAS, for its part, remains a system in which a software layer intervenes to present shares. This distinction matters for performance and for the way data is recovered in the event of a failure, but in both cases the question of backup remains entirely open.

Redundancy is not backup

Here is the heart of the misunderstanding. The RAID of a NAS protects against a physical or mechanical problem affecting one or two disks. And that is all. It does not make a backup, and it must above all not be seen as one.

The reason is simple: RAID keeps only a single live copy of your data. Whatever happens to that copy happens to the entire NAS, instantly. Here is what it does not protect you against.

Threat	What happens on a NAS
Deletion, human error	The deleted file disappears from the entire NAS at once
Ransomware	The connected NAS is encrypted like everything else
Fire, flood, theft	Everything is in the same place, everything is lost together
Software corruption of the NAS	The storage system itself becomes unreadable
RAID configuration failure	The volume is no longer recognised, several disks affected
Failed rebuild	A second disk gives out during the reconstruction

An accidental deletion is erased across the whole volume, with no safety net. Ransomware encrypts the content of the NAS like any other connected disk. A disaster carries off the entire enclosure, redundancy disks included, since they are all in the same room. And since the NAS is first of all a software system, it also has its own failures: corruption of the software, loss of the storage volume's configuration, or several disks giving out.

This last case is frequent and insidious. When a disk fails and a rebuild is launched to replace it, the other disks, of the same age and the same wear, are put through a hard test. It is not rare for a second disk to fail during that reconstruction, and the NAS then finds itself blocked. Proprietary hybrid RAID systems add a further difficulty: their thick software layer sometimes stacks several types of RAID, and when it becomes corrupted, understanding how the NAS had structured its data in order to reconstruct it becomes an expert's task.

Synchronisation is not a backup

"My NAS sends a copy to the cloud, I have nothing to worry about." That is a good idea, and an external copy is useful. But beware the trap of synchronisation.

A synchronisation faithfully reproduces the state of the source, including its errors. If a file is deleted or corrupted on the NAS, the deletion and the corruption are copied identically to the destination. One may well realise a month or two later that data has been lost, only to discover that the synchronisation has erased it everywhere, and that the copies, in the cloud or on tape, have ended up being reset. A synchronisation is therefore not a miracle solution: it is a mirror, and a mirror also reflects the damage.

A real-life case illustrates this perfectly. A factory had synchronised two NAS units more than two hundred metres apart, in two separate buildings. The client believed himself doubly protected. A problem appeared on one of the NAS units, and it synchronised perfectly to the other: the same problem, identical, on both systems. We were able to recover the entire content, but the lesson remains: even two synchronised NAS units are not a fail-safe backup, because they share the same fate in real time.

What a backup really is

A real backup is a copy that nothing happening to the original can reach. This presupposes two qualities that neither RAID nor a simple synchronisation guarantees.

First, it must be separate and disconnected: offline, unplugged from the network, so that ransomware or a mishandling cannot reach it at the same time as the source. Then, it must be located elsewhere, in a physically different place, not in the same premises, in order to survive a fire, a flood or a theft. It is this disconnected and relocated copy that constitutes the true last resort, the one that saves you when everything else has failed.

The NAS keeps all its usefulness: it centralises, it shares, it absorbs the failure of a disk without interrupting work. But it must be paired with a backup that lives elsewhere and offline.

Because when the NAS was the only copy and it fails, only one door remains: the laboratory. We then work on the disks themselves, with a bit-for-bit copy of each, a virtual reconstruction of the RAID and an extraction of the data. This is often possible, but it is a heavy recourse, which nothing replaces better than a backup that already existed, elsewhere, on the day of the problem.

Frequently asked questions

Is a NAS enough as a backup?

No. A NAS, even with RAID, keeps only a single live copy of your data. It protects against the hardware failure of a disk, but not against a deletion, ransomware, a disaster or a corruption. You need a separate and disconnected copy, stored in another location.

What is the difference between RAID and a backup?

RAID is a hardware redundancy: it allows work to continue despite the failure of one or two disks, but all its copies are live and suffer the same fate at the same time. A backup is a distinct and independent copy, which is not affected when the original is deleted, encrypted or destroyed.

Does synchronisation to the cloud protect my data?

Not like a backup. A synchronisation faithfully copies the state of the source, including deleted or corrupted files. An error can thus spread to the cloud copy, and one may notice it too late. A real backup keeps independent copies that the source cannot overwrite.

Can ransomware encrypt a NAS?

Yes. A NAS connected to the network is a target like any other: ransomware encrypts its content just as it does the workstations. This is one of the reasons why an offline copy, physically disconnected, is indispensable.

Do two synchronised NAS units constitute a backup?

No. Two synchronised NAS units share the same state in real time: a problem that appears on one is copied to the other, even hundreds of metres away. They improve availability, but do not replace a disconnected and independent copy.

Can the data of a failed NAS be recovered?

Often, yes. In the laboratory, a bit-for-bit copy of each disk is made, the RAID is reconstructed virtually and the data is extracted. It is, however, a heavy recourse, to be reserved for cases where the NAS was the only copy; a pre-existing backup avoids it.