What is GFS?
GFS is a way to rotate and retain backups so you can restore recent data in fine detail and older data at coarser intervals, without keeping every backup forever. It started as a tape rotation method, and modern backup software and cloud backup services apply the same pattern as a retention policy, such as "keep 7 daily, 4 weekly and 12 monthly restore points."
How the rotation works
| Generation | When it runs | Usual backup type | How long it's kept |
|---|---|---|---|
| Son | Each business day | Incremental or differential | About a week, then reused |
| Father | End of each week | Full | About a month, then reused |
| Grandfather | End of each month | Full | Months or years, often stored off site |
A classic tape example uses four daily tapes (Monday to Thursday), four or five weekly tapes for the Friday full backups, and twelve monthly tapes. The last full backup of each month is promoted to the grandfather set. That is about 20 tapes for a year of history. Some organizations add a yearly set that is kept even longer.
Why use GFS
- Multiple restore points: restore yesterday's version of a file, last week's, or the state from several months ago.
- Recovery from slow-burning problems: if corruption or ransomware went unnoticed for weeks, a weekly or monthly set from before the problem may still be clean.
- Predictable storage: older sets are overwritten on schedule, so media and storage needs stay fixed.
- Retention by policy: the number of each generation kept is set by business and legal retention requirements.
The trade-off is granularity. Within the last week you can restore any day; from four months ago you can restore only that month's snapshot.
Backup types inside a GFS scheme
- Full: copies everything selected. Slowest to run, simplest to restore.
- Incremental: copies changes since the last backup of any type. Fast to run, but a restore needs the last full plus every incremental since.
- Differential: copies changes since the last full. It grows each day, and a restore needs only the last full plus the latest differential.
- Synthetic full: built by combining an earlier full with later incrementals, without reading all the source data again.
GFS vs. the 3-2-1 rule
The two answer different questions. GFS is about time: how often backups run and how long each generation is kept. The 3-2-1 rule is about copies and locations: keep three copies of the data, on two different types of media, with one copy off site. They work together, and sending grandfather sets off site is one way to meet the off-site part of 3-2-1. Neither replaces testing; a backup is proven only when a restore from it works.
GFS on the CompTIA A+ exam
GFS is on the A+ acronym list and is Core 2 material, listed with backup rotation schemes, on-site vs. off-site storage and the 3-2-1 backup rule. Know that:
- Daily, weekly and monthly sets kept for different periods means grandfather-father-son.
- Son is daily, father is weekly and grandfather is monthly.
- Three copies, two media types and one off site is the 3-2-1 rule, not GFS.
- Full backups need the fewest sets to restore; incrementals need the most.