Immutability

Immutability is the guarantee that stored data cannot be changed or removed for a defined period, which protects records from both error and attack. It usually relies on WORM (Write Once, Read Many) storage. It is a storage capability, and it works best when a record of what each file is shows which ones warrant it, because applying it everywhere is costly.

Key takeaways

Immutable storage costs more, so it works best on the files that need it.
WORM storage is the capability most immutability rules rely on.
Protection works best when an organization knows what it is protecting.

What is immutable storage used for?

Mainly two things: records that rules require to stay unchanged, such as financial records, medical records, and legal evidence, and backup copies that must survive an attack. In both cases, the value comes from being able to prove that nobody, including an administrator, could have changed the data.

What is an example of immutable storage?

A hospital copies its imaging archive every night to object storage with a 30-day lock. When ransomware encrypts its live file servers, the attackers also try to delete the backup copies, but the lock blocks every change, even from an administrator account. The hospital restores its images from the last clean copy, and the attack costs days of recovery instead of the data itself. The same lock, set to years instead of days, is how many financial firms keep the trading records that regulators require to stay unchanged.

What is unstructured data protection?

Unstructured data protection is the set of measures that keep file data safe from loss, corruption, and attack, such as backup, snapshots, replication, immutability, and access controls. It works best when the organization knows what it is protecting. An accurate index shows which files are critical, which are sensitive, and which have no remaining value, so protection spending goes where it matters.

Does immutability protect against ransomware?

It protects the copies that are immutable. Ransomware cannot encrypt or delete an immutable backup during its lock period, so the organization can restore from it. It does not protect the live files people work on every day, and it does not stop data from being stolen. Immutability is one part of a recovery plan, not the whole plan.

Can immutable data ever be deleted?

Yes, once its lock period ends. Immutable storage keeps each file or object unchangeable for a set time, and after that it can be deleted like any other data. That is why the lock period should match the retention period: too short and the protection ends early, too long and the organization pays to keep data it is allowed to remove.

How do you make data immutable?

With storage that can lock data for a set period. Common options are object storage with object lock, file systems and backup targets with WORM settings, and locked snapshots. In each case, the lock period is set when data is written, and nobody, including administrators, can change or delete the data until it ends.

How does metadata help during a ransomware attack?

It helps at three moments:

Spotting it: a sudden jump in modified files, or thousands of files gaining an unfamiliar extension, shows up in metadata between two scans.
Scoping it: comparing the latest scan with the last clean one lists which systems, folders, and owners were affected.
Restoring: knowing which files were affected, and which of them matter most, lets teams restore in the right order instead of restoring everything.

Metadata does not stop an attack, but it shortens the time spent working out what happened.

How does Diskover help?

Diskover shows which files are critical, sensitive, or no longer needed across every storage system, so protection and immutability go where they matter most.

Explore global visibility

Book a demo