@truls46 By having the backup medium be enforced append-only from backup clients, and keeping enough past (preferably incremental so you don't need astronomical amounts of storage) images that you're sure to have one before unnoticed catastrophic loss.