The 1-2-3 archival rule

The rule, in one line

One master file. Two physical locations. Three virtual clones. Seven years.

It is a deliberately conservative standard, and it exists because of a specific asymmetry: storage is cheap and predictable, while a lost deposition master is unrecoverable, non-substitutable, and lands on you personally as the Officer of the record. There is no reshoot. The witness will not sit again.

One master file

The master is the single file you would re-deliver from if every copy in the world disappeared tomorrow. It is one designated file per stream per job — not a folder of everything that came off the card, and not the compressed copy you emailed to counsel.

Designate it at ingest, on the same day, before anything else happens to it. The two failure patterns here are equally common: keeping everything, so nobody can tell which file is authoritative four years later; and keeping only the delivered copy, so you cannot produce an original when someone questions whether the video was altered.

Whether the master is the camera original or the encoded deliverable is a real choice with a real cost. Archiving ProRes for seven years is defensible. It is also roughly fifteen to twenty times the storage of an H.264 master at the same duration. Price it before you commit to it — the Archival Storage Planner will show you the seven-year difference against your actual volume.

Two physical locations

Two copies, on separate media, in separate buildings. Not two drives on the same desk. Not a drive and a second partition. Not the NAS and the laptop that lives next to the NAS.

The threat model isn't drive failure — that's what redundancy inside a single machine handles. It's the single-site event: fire, flood, burglary, a landlord's sprinkler head, the office you no longer have access to after a dispute. If one address can take out both copies, you have one copy.

Drives fail on a schedule, so treat physical media as consumable. Spinning disks that sit powered-off for years develop problems you won't notice until you need the file. Power the archive drives up, read them, and confirm they mount — annually at minimum.

Three virtual clones

Three cloud copies, in distinct providers or distinct regions. Not three folders in the same bucket.

The reason for three rather than the more familiar one: cloud copies are the layer you will actually rely on, because they're the layer that survives losing physical access to your own office. Provider-level and region-level failures are rare, but so is everything else on this list, and account-level failures — a billing lapse, a suspension, a mistaken deletion propagated by sync — are not rare at all.

Archive-priced object storage runs a fraction of a cent per gigabyte per month, which makes three copies genuinely affordable. Watch retrieval pricing rather than storage pricing: deep-archive tiers are cheap to hold and expensive to read, and the moment you need a seven-year-old file is the moment a firm is waiting on it. Keep at least one of the three copies on a tier you can restore from same-day.

Uploading three clones after every job is a real time commitment on hotel and courthouse connections. The Transfer Time Estimator tells you what that upload actually costs you in hours before you promise a delivery window on top of it.

Seven years

Seven years is a floor chosen to outlast the ordinary life of a civil case — discovery, dispositive motions, trial, post-trial motions, and an appeal — plus the malpractice and fee-dispute tail that follows it. It is not a legal citation. It is the number that covers the cases you would otherwise be caught short on.

Three things extend it. A protective order may impose its own retention, destruction, or return obligations, and those override your default policy in both directions — sometimes requiring you to hold longer, sometimes requiring you to destroy on a schedule and certify that you did. Your engagement letter may commit you to a specific term; read it before you set your policy, not after. And your state's rules may attach requirements to the recording that the federal rules do not.

Where a protective order and your default policy conflict, the order wins. Read it.

Verify, or you don't have an archive — you have a hope

A copy you have never read is a copy you cannot count on. Bit rot, silent corruption during transfer, and truncated uploads all produce files that look present in a directory listing and fail on playback.

The minimum discipline: generate a checksum for the master at ingest, store it alongside the file, and verify each copy against it after it lands. Then re-verify on a schedule — annually is enough — and re-copy anything that drifts. This is also the practical answer to an authentication challenge: a hash captured at ingest and carried forward is direct evidence that the file produced years later is the file that came off the camera.

Get the deletion side right too

Retention has an end. When the seven years run — or when a protective order's clock does — delete deliberately, across all five copies, and record that you did it: what job, what date, what authority. An archive nobody ever prunes becomes an indefinite liability, and "I think we still have it somewhere" is the worst possible answer to a subpoena.

What this costs, and why it's still the cheap option

Run your real numbers — jobs per month, hours per job, streams per job, archive format — through the Archival Storage Planner. Most working members are surprised twice: first at how much the seven-year total is, and then at how small it is next to a single day's billing.

That's the whole argument. Archival is a line item you can price, budget, and pass through on your rate card. A lost master is a claim, a credential problem, and an attorney who never calls again.

Where this is taught

Archival, witness review under FRCP 30(e), and the post-deposition certification workflow are the final module of the CDVS curriculum. If you want the surrounding context first, Deposition Video 101 is free and takes about an hour.