Forty terabytes are not forty days. Let us do the sum.

What it sells is that it can be administered without being a specialist. It goes in the cabinet, the drives go in, it is configured from the browser and from then on there are email alerts when a drive starts behaving oddly, a backup system with schedules, and users and permissions. For a company without a large IT department, that is worth more than a few tenths of performance.

In video it turns up in three ways. As the storage a video server records onto, with the volume mounted over the network. As the place where the copy of what has to be kept longer is left. And, in small installations, as the recorder itself, with the video software running inside the box.

And it has one thing worth looking at that almost nobody looks at: the list of validated drives. A drive fitting in the bay does not mean it has been tested there. With continuous recording that list matters, because a drive that is not validated can work for months and then cause problems nobody puts down to the drive.

A camera sending three megabits per second writes, over a whole day, a little over thirty gigabytes. Twenty cameras like that are over six hundred gigabytes a day. On that basis, forty terabytes give about sixty days. That is the brochure sum, and it is the one that is never met.

What eats those days are four subtractions nobody does. First: the capacity on the box is not what is left after formatting, and what is lost is not small. Second: if there is redundancy, one or two drives do not count as capacity —they are the ones that let one break without losing anything—. Third: a volume filled to the brim behaves badly, so a margin is held back. And fourth, the worst: the camera's three megabits are an average, and in a scene with movement they go a good deal higher.

That fourth one is what breaks contracts. Modern compression spends little when the image is still and a lot when everything moves. The sum was done in January, with twelve cameras and few hours of daylight; summer arrives, with fourteen hours of sun, trees moving and the car park full, and the real rate goes up. The drive is the same and the sixty days have become thirty-five.

So the honest way to give a number is this: do the sum, leave a margin, and two weeks into operation measure what is really being written and correct it. A recording period without that second part is an estimate dressed up as a commitment.

With redundancy, a drive breaks and nothing visible happens: the system carries on recording and raises an alert. The new drive goes in and it starts to rebuild, that is, to fill it back up from the others. That takes time, and the bigger the drives, the more: in a full enclosure it can be many hours, and in some cases days.

For all of that time two things happen at once. The other drives are working flat out, which is when one of them is most likely to give up; and the system has no safety net, because the drive that protected it has already been spent on this fault. If the second drive goes then, there is nothing to rebuild from. That is why with large drives it is as well to tolerate two failures and not one, and that is why a spare drive waiting in the enclosure itself —one that steps in on its own as soon as one fails— is worth what it costs.

And the reminder that always has to be repeated: that is not a backup. It protects against a drive breaking and nothing else. It does not protect against somebody deleting the recordings, or against the room burning, or against the whole set of equipment being taken away, which is the first thing anyone who knows what they are doing takes.

It fits very well in medium-sized installations: one site, between a few and a few dozen cameras, a reasonable recording period and one or two people watching. It fits as the destination for the copy of what has to be kept, and as a second place to leave what cannot be lost. And it fits where there is no IT department, because it can be administered with short training.

It stops fitting for three reasons. The first is throughput: many cameras writing at once onto a volume over the network, and at the same time people reading recordings from days ago, is a profile that asks more than it looks. The second is continuity: this equipment has a single controller, so a fault in the box itself —or an update— leaves the storage stopped, and a system that cannot stop needs another class of enclosure. The third is capacity: there comes a point where growing by adding expansion enclosures turns into a pile of chained boxes, and that is fragile to maintain and hard to keep an eye on.

As the only place where the recording of something important lives, no. If the recording of that industrial unit is what is going to hold up a claim, there has to be a copy somewhere else, however small or however selective.

Nor as the storage of a large installation with many workstations reading at once, or in a system that cannot stop for even half an hour. And we would not fit it with desktop drives inside: that is the quickest way to save today and lose recordings in two years' time.

And we would not put it out on the internet. Network storage reachable from outside, not updated and with the factory password, is a target: there have been whole waves of attacks against equipment like that. This lives on its own network, with no direct way out, and it gets updated.

The administration is among the simplest in this whole field: it is done from the browser, the alerts are clear and changing a broken drive is opening the bay and putting the new one in. One IT person, or even a maintenance person with a couple of hours of training, can run it: look at the status, deal with an alert, replace a drive and check that the copies are being made.

The three things worth putting in writing are: that equipment updates are applied in an agreed window, because the storage restarts and recording stops meanwhile; that nobody keeps other company files there, because the day the volume fills up recording stops; and that when a drive is changed the date is written down, so you know how many years the others have been in.

Our part afterwards is redoing the sum when new cameras come in or the quality of one goes up, deciding whether it is time to change league and checking once a year whether the recording period in the contract is the one the system is really giving. Asking for the recording of the oldest day promised is the check that produces the most surprises.