WORM and immutability are closely related terms in backup storage. Storage products differ in which data they protect and whether authorized users can remove protection before retention expires.
How WORM and Immutability Relate
WORM means Write Once, Read Many. Once data is written, the storage system prevents it from being overwritten or erased while its WORM protection applies. Immutability describes the protected state of that data. WORM is one way to achieve it.
WORM can be implemented by tape-drive controls or by storage software. IBM’s tape documentation describes firmware preventing changes to data on compatible WORM cartridges. Amazon S3 Object Lock and Azure immutable blob storage also use a WORM model, enforced through retention policies and legal holds.
The storage medium and software both affect protection. Administrative permissions also matter. Some retention modes prevent early deletion by any user; others allow an authorized override.
The article on immutable storage covers its use in backup repositories.
Retention, Versions and Independent Copies
A retention period defines how long protection applies to a copy. A legal hold can preserve data until an authorized user clears it, without a fixed expiry date. Support for these mechanisms varies by storage product.
Versioning lets an application write a new version while an earlier protected version remains unchanged. It does not automatically lock every version. In S3, unprotected object versions can be permanently deleted. Object Lock protects the specific versions covered by its retention settings or legal holds.
Snapshots need configured protection against deletion. A snapshot on the original repository depends on that repository’s availability. An independently managed copy supports recovery if the original system is lost. Planning immutable storage includes deciding which copies to keep locally and which to store at another location.
Protection Modes and Early Removal
S3 Object Lock and vStor snapshot locks each offer modes with different rules for early removal. The table summarizes their scope and permissions for early removal.
| Protection mode | Protected data | Early removal or change |
|---|---|---|
| S3 Object Lock, compliance mode | The object version covered by retention | No user, including the account root user, can shorten retention or delete the version during that period |
| S3 Object Lock, governance mode | The object version covered by retention | Users with the required bypass permission can override protection |
| vStor Fixed Protection | The snapshot with the fixed deletion lock | The lock cannot be changed or disabled before retention expires |
| vStor Flexible Protection | The snapshot with the flexible deletion lock | Authorized users can adjust or remove the lock using MFA |
The S3 retention documentation describes the limits of these modes, including account deletion. The vStor immutability guide documents snapshot locks and the other controls below. These controls operate within the storage system and cannot prevent loss of its underlying infrastructure.
What vStor Protects
Catalogic DPX uses vStor as a backup repository. vStor provides separate controls for snapshots, volume deletion and file immutability.
Snapshot Protection
A snapshot deletion lock protects the retained snapshot against modification and deletion. Fixed Protection keeps the lock in place until its retention period expires. Flexible Protection allows authenticated changes or removal using multifactor authentication (MFA). MFA must be enabled before deletion-lock controls can be used; it does not permit early removal of a fixed lock.
vStor can apply a default deletion-lock policy to new snapshots on an eligible volume. The policy takes effect for snapshots created after it is configured; existing snapshots retain their previous settings.
Volume Deletion and File Immutability
A volume deletion lock prevents deletion of the volume and can be disabled with MFA. Active files remain changeable unless protected separately. This lock has no fixed snapshot-retention period.
File immutability protects files against modification or deletion. The controls apply immutability to existing files on a volume or remove it from them, with MFA required for removal.
Protected Replication
vStor can apply deletion locks to replicated snapshots as they arrive on the target, using the selected fixed or flexible mode. This requires deletion-lock settings on the replication relationship.
Changing the replication lock setting does not remove or alter locks already applied to uploaded snapshots. The replication deletion-lock documentation describes configuration and requirements.
Retention and Compliance Requirements
Recordkeeping requirements differ by regulation. For broker-dealers, SEC Rule 17a-4 permits a qualifying audit-trail alternative to WORM. That alternative must allow the original record to be recreated if it is modified or deleted.
Healthcare records also need a process for amendments. HIPAA includes rights to request amendments to protected health information. A system can preserve an earlier protected version while recording an amendment, but storage locks alone do not establish compliance with the wider privacy and security requirements.
Under GDPR, erasure rights apply in defined circumstances and have exceptions, including necessary processing to meet legal obligations. The European Commission’s guidance explains those limits. Backup retention policies need to account for the lawful purpose of retention and the handling of erasure requests.
Recovery Validation
An immutable recovery point can contain compromised data. Recovery validation checks the backup’s condition and whether the workload can be restored within its recovery time objective (RTO).
GuardMode provides ransomware detection. GuardMode Scan in vStor examines mounted filesystems for suspicious files and signs of encryption. Its results provide evidence for assessing a recovery point, with no guarantee that every file is free of compromise. Reviewing scan findings and testing the restored workload are part of cyber-resilient recovery.
Access restrictions and independent copies address risks beyond changes to protected data. The SDS backup target comparison discusses repository selection and operating costs.
Evaluating Backup Storage Protection
A storage evaluation should establish the following:
- Which snapshot, file or object version receives protection?
- Can its contents be overwritten, or can the whole copy be deleted?
- When does protection end, and who can change it before then?
- What happens to the protected copies if the repository becomes unavailable?
- Can your team restore the required workload within its RTO?
The DPX immutable backup storage page describes the available deployment options.
Pawel Staniec
CTO
Pawel is CTO at Catalogic Software, where he owns DPX product architecture and technology direction and works with our developers, alliance partners and customers across EMEA to keep what we build aligned with how our data protection products are actually deployed. He writes about the engineering behind our releases, including NDMP backup management, Proxmox VE protection, and where hypervisor-native backup tooling stops being enough.
