The 1-2-3 archival rule

The rule, in one line

One master file, two physical locations, three virtual clones, and seven years of retention. The rest of this guide is what each of those four numbers actually means once you try to apply it to a working archive.

It is a deliberately conservative standard, and it exists because of a specific asymmetry: storage is cheap and predictable, while a lost deposition master is unrecoverable, non-substitutable, and lands on you personally as the Officer of the record. There is no reshoot. The witness will not sit again.

One master file

The master is the single file you would re-deliver from if every other copy in the world disappeared tomorrow. That means one designated file per stream per job, which is not the same thing as a folder holding everything that came off the card, and it is certainly not the compressed copy you emailed to counsel back in March.

Designate it at ingest, on the same day, before anything else happens to it. The two failure patterns here are equally common: keeping everything, so nobody can tell which file is authoritative four years later, and keeping only the delivered copy, so you cannot produce an original when someone questions whether the video was altered.

Whether the master is the camera original or the encoded deliverable is a real choice with a real cost. Archiving ProRes for seven years is defensible. It is also roughly fifteen to twenty times the storage of an H.264 master at the same duration. Price it before you commit to it - the Archival Storage Planner will show you the seven-year difference against your actual volume.

Two physical locations

You want two copies on separate media in separate buildings, and the separation is the whole point of the requirement. Two drives sitting on the same desk is one location, a drive plus a second partition is one drive, and the NAS plus the laptop that lives next to the NAS is still one building. The threat you are guarding against is the room, not the hardware.

The threat model isn't drive failure - that's what redundancy inside a single machine handles. It's the single-site event: fire, flood, burglary, a landlord's sprinkler head, the office you no longer have access to after a dispute. If one address can take out both copies, you have one copy.

Drives fail on a schedule, so treat physical media as consumable. Spinning disks that sit powered-off for years develop problems you won't notice until you need the file. Power the archive drives up, read them, and confirm they mount - annually at minimum.

Three virtual clones

Three cloud copies, held in distinct providers or at least distinct regions. Three folders inside the same bucket will not survive an account-level problem, and account-level problems are considerably more common than the provider outages people tend to worry about instead.

The reason for three rather than the more familiar one: cloud copies are the layer you will actually rely on, because they're the layer that survives losing physical access to your own office. Provider-level and region-level failures are rare, but so is everything else on this list, and account-level failures - a billing lapse, a suspension, a mistaken deletion propagated by sync - are not rare at all.

Archive-priced object storage runs a fraction of a cent per gigabyte per month, which makes three copies genuinely affordable. Watch retrieval pricing rather than storage pricing: deep-archive tiers are cheap to hold and expensive to read, and the moment you need a seven-year-old file is the moment a firm is waiting on it. Keep at least one of the three copies on a tier you can restore from same-day.

Uploading three clones after every job is a real time commitment on hotel and courthouse connections. The Transfer Time Estimator tells you what that upload actually costs you in hours before you promise a delivery window on top of it.

Seven years

Seven years is a floor, chosen to outlast the ordinary life of a civil case, which runs through discovery, dispositive motions, trial, post-trial motions, and an appeal, and then to cover the malpractice and fee-dispute tail that follows all of that. It is not a legal citation and we do not present it as one. It is simply the number that covers the cases you would otherwise be caught short on.

Three things extend it. A protective order may impose its own retention, destruction, or return obligations, and those override your default policy in both directions - sometimes requiring you to hold longer, sometimes requiring you to destroy on a schedule and certify that you did. Your engagement letter may commit you to a specific term, so read it before you set your policy, not after. And your state's rules may attach requirements to the recording that the federal rules do not.

Where a protective order and your default policy conflict, the order wins. Read it.

Verify, or you do not have an archive

A copy you have never read is a copy you cannot count on, and that is worth sitting with for a moment. Bit rot, silent corruption during transfer, and truncated uploads all produce files that look perfectly present in a directory listing and then fail on playback. Read the archive drives at least annually, confirm they mount, and re-copy anything that has drifted.

The minimum discipline: generate a checksum for the master at ingest, store it alongside the file, and verify each copy against it after it lands. Then re-verify on a schedule - annually is enough - and re-copy anything that drifts. This is also the practical answer to an authentication challenge: a hash captured at ingest and carried forward is direct evidence that the file produced years later is the file that came off the camera.

Get the deletion side right too

Retention has an end, and the end deserves as much discipline as the beginning. When the seven years run out, or when a protective order's clock does, delete deliberately across all five copies and record that you did it: what job, what date, and under what authority. An archive nobody ever prunes turns into an indefinite liability, and "I think we still have it somewhere" is the worst available answer to a subpoena.

What this costs, and why it is still the cheap option

Run your real numbers through the Archival Storage Planner, including jobs per month, hours per job, streams per job, and archive format. Most working members are surprised twice, first at how much the seven-year total comes to, and then at how small that total looks next to a single day's billing.

That's the whole argument. Archival is a line item you can price, budget, and pass through on your rate card. A lost master is a claim, a credential problem, and an attorney who never calls again.

Where this is taught

Archival, witness review under FRCP 30(e), and the post-deposition certification workflow make up the final module of the CDVS curriculum. If you want the surrounding context first, our Deposition Video 101 course is free and takes about an hour.