A Photo Archive That Still Opens in Ten Years

A photograph archive still opens in ten years if the files sit in formats that software keeps reading, if the drive is read on a schedule, and if the whole set is copied to new media before the old media dies. Nothing about this is automatic. It is a maintenance job, the same as dusting a case fan or checking a battery. The work is small and regular: read the drive, compare checksums, migrate formats that are fading, and rehearse a restore while the originals are still healthy.

Which image formats survive a decade of software changes?

Three families have held up: TIFF, JPEG and PNG. A plain TIFF written in 2010 opens in current editors on Windows, macOS and Linux. JPEG is the most widely implemented image format in existence, and its lossy compression is fixed by an international standard, so a JPEG from an old camera still decodes. PNG covers screenshots, diagrams and graphics with sharp edges.

Formats tied to one vendor or one application are the risk. Camera raw files are the clearest case: a .CR2 from 2008 may need a converter that the camera maker no longer ships for a current operating system. Adobe's Digital Negative specification, published as an open format, exists to move raw data into something a future program can read. If an archive holds raw files, keep a TIFF or JPEG beside each one.

Layered working files are the second risk. A .PSD or .XCF depends on the application that made it. Flatten a finished image to TIFF and store the layered file as a secondary copy, not the only one.

Metadata matters as much as pixels. Write captions, dates, locations and rights into the file itself, in IPTC or XMP fields, not only into a database beside it. A folder of unnamed files with a separate spreadsheet is one lost spreadsheet away from being unreadable in practice. Photographers who plan shoots around buildings, interiors and public spaces already think in shot lists and delivery files, and the same discipline applies to archiving architectural photography once the shoot is over: name the building, the room, the date, and the light.

How often should an archive drive be read to prove it still works?

Read every archive drive at least once a year, and read any drive holding the only copy of something every three to six months. A drive that is never powered on cannot report its own condition. Spinning disks that sit idle for years can develop stuck bearings and weak sectors; solid state drives that sit unpowered for long periods can lose charge in their cells. Manufacturers publish retention guidance for unpowered solid state drives, and the numbers are shorter than most owners assume.

A read pass means more than opening a folder. Open a sample of files, run a checksum over the whole set, and compare the result with the checksum recorded when the files were written. Free tools compute MD5 or SHA-256 hashes for a directory tree. A mismatch means the file changed or the media is returning bad data. A drive that reports read errors, that disappears from the operating system, or that makes clicking noises has reached the end of its service life.

Watch the drive's own health counters. S.M.A.R.T. data, available in the operating system's disk utility or in a manufacturer tool, reports reallocated sectors, pending sectors and power-on hours. A rising reallocated sector count is a drive telling the owner to copy the data now, not next year.

What is the difference between a backup and a copy?

A copy is a second set of files. A backup is a second set of files plus a way to restore them, plus a record that proves the restore works. Two folders on the same drive are copies of each other and share one point of failure. Two drives in the same room share a fire, a flood and a power surge. A backup has a version history, so a file deleted or overwritten by mistake can be brought back from an earlier date.

The practical rule is three copies, on two kinds of media, with one kept off site. An external hard drive at home, a second drive at another address, and a cloud or optical copy cover the common failures. Optical media has its own clock: recordable discs have published life expectancies, and pressed discs outlast burned ones. Tape remains in use in institutions for the same reason, long shelf life and a known migration path.

A backup also needs a restore procedure written down. Which drive, which cable, which software, which password. A backup whose password is lost is a copy of nothing.

How does a reader test a restoration before it is needed?

Pick a folder at random, restore it to a clean drive, and open the files. Do this twice a year. The test answers three questions: does the backup software still run on the current operating system, does the media still read, and do the restored files open in a current viewer.

A full rehearsal goes further. Restore a whole year of a project to an empty drive, then compare file counts and checksums against the source. Time the restore and write the number down. A restore that takes three days is a fact the owner needs before a deadline, not during one.

Keep one old machine or one virtual machine able to open legacy formats. A ten-year-old laptop with its original operating system and its original editing software is a working reader for files that current software has dropped. Store it dry, power it up once a year, and keep its charger.

What a migration schedule looks like

A migration is a planned copy from old media to new media, with verification at both ends. Storage media have service lives measured in years, and the schedule follows the media, not the calendar year.

• Every three months: read the drive holding the only copy, run checksums, check S.M.A.R.T. counters.
• Every six months: restore a sample folder to a clean drive and open the files.
• Every year: read every archive drive, refresh the off-site copy, power up the legacy reader.
• Every three to five years: copy the whole archive to new drives, verify the copy, retire the old drives.
• Every five to seven years: review file formats and convert anything that current software no longer opens.

Write the dates in a log. A maintenance log turns an archive from a hope into a record.

Where the line is

An owner can open a desktop case, unplug a data drive, connect it to another machine, run checksums and copy files. That work is safe with the power off and the cable pulled.

An owner should not open a power supply unit, a battery pack that has swollen, or anything behind a panel carrying mains voltage. A swollen lithium battery is a fire risk and goes to a recycling point, not to a workbench. A drive that clicks, a drive that smells hot, and a drive that has been through a flood are all candidates for professional recovery, and the first rule of recovery is to stop writing to the drive.

The archive itself is the part an owner controls. Formats chosen now decide what opens later. A read pass done this month decides whether the drive is still trustworthy next year. A restore tested today decides whether the backup is real.