Keeping a copy of your backups offsite

A backup on a drive next to the PC is lost with the building. Keep a second copy somewhere else, and GBM AI looks after it for you.

The second copy does it for you#

Turn on Keep a second copy somewhere else on a job, and every backup is copied, as it is stored, to a second place:

To turn it on:

1. On Jobs, click Edit on the job and go to the Where step.
2. Switch on Keep a second copy somewhere else, choose the place, and click Test second copy.
3. Save the job.

Wizard step 2 - a second copy on another drive

What the second copy does that a copy tool cannot:

• Only finished, checked backups. A backup is copied after it completes and passes its check, never while it is being written.
• Checked on arrival. On a drive or a share every file is read back and compared; in a bucket every upload carries a checksum the bucket checks.
• It waits. When the USB drive is at home or the NAS is off, the copy waits and catches up by itself when it is back.
• Restore uses it. Restore shows where each backup is held, and takes it from the copy when the first place is gone.
• Whole chains. The copy keeps backups by its own rule (the same as the job, the last 30 days, the last year…) and never splits a chain of incremental backups.

See Keeping a second copy for every detail.

Straight to the cloud#

With Pro and up, a job can back up to an S3 bucket itself: the backup is offsite from the first run. See Backing up to S3-compatible cloud storage.

On a server: a copy nobody can delete#

Ransomware that reaches a server deletes the backups it can see, the offsite copy too if it can reach it. Two things in GBM AI stop that:

• Locked backups in S3. In a bucket with Object Lock, each backup is locked for the days you choose. Until then nobody can change or delete it: not GBM AI, not a program that took over the server with the bucket's keys, and in compliance mode not even the bucket's owner. See Locking backups in S3.
• Checks of old backups. GBM AI reads old backups again now and then, and a damaged file is taken from the second copy at restore. See Checking old backups.

Restoring from the copy#

• On the same PC: nothing to do. Restore takes the backup from the copy when the first place is not there.
• On another PC: open Restore, click Open backups… and choose A folder or drive… for a drive or a share, or An S3 bucket… for a bucket. See Restoring backups made on another PC.
• An encrypted backup needs the job's password from either copy.

If you already copy with a tool of your own#

Some offices already copy a folder offsite every night with a script or their NAS's replication. Pointed at a GBM AI backup folder, such a tool must follow three rules, or the copy may not restore:

1. Copy only finished backups. Each backup is a folder of its own, like Documents & Desktop_20261015-020000. GBM AI writes a .gbmai-complete file into it last, when the backup is finished; nothing in the folder changes after that. Copy a folder only when it has that file, and copy the file last. (Backups made before GBM AI 10.2 have no such file: copy them once, at a time no backup runs.)
2. Leave the db folder out. It is this PC's catalogue of the job; it changes during every backup and a restore never needs it. Copy gbm-ai.json beside the backups: it names the job, and GBM AI needs it to find the job in an S3 bucket.
3. Keep chains whole. An incremental or differential backup restores together with the backups before it, back to the last full one. Do not let a rule in the copy's storage delete old folders on its own.

For example, this PowerShell script copies each finished backup of one job once, and never leaves a half copy that GBM AI would offer as a backup:

# Copies the finished GBM AI backups of one job to another place.
$From = 'H:\Backups\Documents & Desktop'                 # the job's folder
$To   = '\\offsite-nas\Backups\Documents & Desktop'      # where the copy goes

New-Item -ItemType Directory -Force -Path $To | Out-Null
foreach ($set in Get-ChildItem -LiteralPath $From -Directory) {
    $marker = Join-Path $set.FullName '.gbmai-complete'
    $target = Join-Path $To $set.Name
    if ($set.Name -eq 'db' -or -not (Test-Path -LiteralPath $marker)) { continue }   # not a finished backup
    if (Test-Path -LiteralPath (Join-Path $target '.gbmai-complete')) { continue }   # already copied
    $part = "$target.gbmai-copy"
    robocopy $set.FullName $part /E /XF .gbmai-complete /R:2 /W:5 /NP /NFL /NDL /NJH /NJS
    if ($LASTEXITCODE -ge 8) { Write-Warning "$($set.Name) was not copied (robocopy $LASTEXITCODE)"; continue }
    Copy-Item -LiteralPath $marker -Destination $part
    Rename-Item -LiteralPath $part -NewName $set.Name
}
Copy-Item -LiteralPath (Join-Path $From 'gbm-ai.json') -Destination $To -ErrorAction SilentlyContinue

It copies each backup into a folder ending in .gbmai-copy, which GBM AI never lists, and gives it its real name once it is complete. Run it from Task Scheduler with powershell -NoProfile -ExecutionPolicy Bypass -File <the script>, a little after the job's backups usually finish. A copy cut short is finished by the next run.

Related articles#

• Keeping a second copy
• Locking backups in S3
• Checking old backups
• Restoring backups made on another PC
• The four backup types