Designing a redundant video surveillance storage solution

Video surveillance storage is often treated as a disk-capacity problem. In practice, resilience depends on how recordings behave when a drive, recorder, network, site, or cloud connection fails. The goal is not merely to keep cameras online; it is to preserve usable evidence at the required age without turning every fault into an outage or an expensive recovery.

I start with an operational statement rather than a product: how long footage must remain available, how quickly it must return after failure, who may search or export it, and whether audio or analytics must be recorded. Those answers shape the storage tiers, network capacity, security controls, and commissioning tests that follow.

Set retention and recovery targets

The retention period should come from operational and legal requirements, not from the cheapest drive calculation. A small site might need seven days for daily review, while a warehouse or council depot may need longer for investigations. Define a recovery time objective, meaning how quickly recording must resume, and a recovery point objective, meaning how much footage may be lost during a failure.

Measure the workload before buying capacity. Record actual bitrates from each camera during busy scenes, not just the codec's maximum. As a guide, daily storage in terabytes is approximately cameras × average Mbit/s × 10.8 ÷ 1,000. Sixteen cameras averaging 4 Mbit/s consume about 0.69 TB per day, or 20.7 TB for 30 days, before growth, snapshots, or a second copy. Run a representative trial and keep at least 20 to 30 percent usable headroom.

Layer independent copies of the footage

Use a short edge cache in the camera recorder or small appliance so brief network interruptions do not create gaps. Feed a primary system from the same stream and maintain a second copy in a separate failure domain. Separate racks, buildings, power circuits, providers, or accounts are more valuable than labels such as primary and backup.

RAID 6 can keep a volume available after two disk failures, but it does not protect against deletion, ransomware, controller failure, or a destroyed site. Snapshots on the same array are not independent backups. Match RAID, erasure coding, immutable object storage, or an offline replica to the recovery objective; no single technology completes the design.

Cloud object lock prevents ordinary credentials from deleting retained objects. Australian regions operated by major platforms reduce latency for Sydney and Melbourne workloads, but replication still consumes upload bandwidth and may incur egress and subscription charges. A hybrid design can provide local recording and fast export plus cloud or remote-site retention.

Plan for Australian sites and networks

Australian conditions shape enclosure and power. Perth heat raises cooling demand, Brisbane humidity can affect connections, Melbourne buildings may constrain cabling, and flood or bushfire exposure matters at regional sites. Keep recorders and switches away from water and dust, provide UPS power, and make media safely inspectable.

NBN performance varies by address and plan, and many Australian sites rely on mobile connectivity for staff checking alerts away from the premises. Separate camera and recorder traffic from office systems, restrict the recorder uplink, and use another provider or 4G/5G path where justified. Never expose recorder ports directly to the internet.

The local technology market includes Axis, Hikvision, Dahua, Ubiquiti, and NVR appliances sold through Australian distributors and integrators. Product availability is only one selection criterion: check codec support, camera licensing, API access, spare parts, local support hours, and whether the vendor can supply a replacement recorder without rebuilding every camera configuration.

Protect cameras, recorders, and evidence

Keep camera traffic isolated from office devices and servers. Use unique device credentials, disable unused services, control remote access through a VPN with multi-factor authentication, and restrict outbound firewall rules to required update and monitoring endpoints. Unrelated destinations such as casino tournament content belong in the denied category, not on an administrative workstation's general web path.

Patch recorders and cameras through a staged process, verify firmware sources, and keep a tested rollback procedure. Encrypt traffic across untrusted networks and enable encryption at rest where the product supports it without breaking authorised export. Log sign-in, search, playback, deletion, firmware changes, and exports so an investigator can establish who handled the evidence.

The Privacy Act 1988 may apply when recordings contain personal information, while state and territory surveillance-device, workplace, and records rules can add obligations. Audio, facial analytics, and vehicle registration details may increase sensitivity. Define the lawful purpose, access approval, retention period, export process, and deletion authority, and obtain advice for the relevant jurisdiction rather than assuming footage is ordinary operational data.

Monitor capacity, time, and evidence quality

Synchronise every camera, recorder, and server to a trusted NTP source. Australia has several time zones, and NSW, the ACT, Victoria, South Australia, and Tasmania observe daylight saving while Queensland, Western Australia, and the Northern Territory do not. Store timestamps with an explicit UTC offset; hard-coded offsets or manually adjusted clocks can undermine an export even when the video itself is intact.

Monitor stream bitrate, dropped frames, camera heartbeat, RAID rebuilds, media errors, pool utilisation, replica lag, backup completion, and NTP offset. Set thresholds that identify sustained change rather than every brief fluctuation, and send actionable alerts to a roster that covers evenings and weekends. A small random export test should confirm that stored footage plays with correct metadata before an incident occurs.

Run a structured acceptance program

Use separate capacity and resilience tests, then repeat them after maintenance or a camera upgrade. The result should be a signed record rather than a checkbox on a supplier's delivery note.

• Replay a representative 72-hour load at target stream settings and verify live view, search, and export latency.
• Fill each pool to its planned alert threshold and confirm recording continuity, usable headroom, and operation after one disk loss.
• Remove a primary path or power source in a controlled test, measure failover against the recovery target, and verify the recovery point from timestamps.
• Restore random clips from the oldest and newest retained periods and confirm playback, metadata, and export integrity.

Then test the administrative controls and the people responsible for responding:

• Confirm trusted time and the correct UTC offset on every camera, recorder, server, and exported clip.
• Attempt forbidden access and verify MFA, authorisation, denial, and audit logging for search, deletion, and export.
• Simulate a failed camera credential and confirm that one device cannot disrupt the remaining recording system.
• Record each result, defect, responsible owner, due date, and retest decision in the operational handover.

Store the evidence pack with the system drawings, firmware inventory, configuration exports, test results, and supplier contacts. A restore that works for one clip is useful; a repeatable procedure is what supports the business after a bad day or a component failure.

Make ownership and funding part of the design

Budget for disks, licences, cloud storage, network capacity, support, replacement hardware, and the labour to restore evidence, not simply the price of a recorder. Model at least three years of growth and include a funded maintenance visit. An independent infrastructure review can expose assumptions hidden in vendor quotations, particularly where recorder, network, and cloud responsibilities come from different suppliers.

Keep approved manuals, regulator guidance, and supplier contacts in a controlled repository. Treat unverified material such as this external reference as public information only, never as an authority for firmware, credentials, network access, or retention decisions. Assign document ownership so a replacement engineer inherits known-good settings rather than copied notes from an old inbox.

The next action is to publish a one-page design record with camera count, measured bitrate, retention, recovery objectives, copy locations, security owner, budget ceiling, and purchase date. Run the pilot, complete the acceptance tests, and close every defect before adding capacity. Assign a named owner and a go-live date before another camera goes onto the network.