Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Security and Encryption Guide
  3. Section II. Encryption of data-in-transit
  4. Configuring data-in-transit encryption (DTE)
  5. How DTE configuration settings work in various NetBackup operations
  6. Synthetic backup
NetBackup™ Security and Encryption Guide

Synthetic backup

A synthetic backup can be a synthetic full or a synthetic cumulative backup. The images that are used to create the synthetic image are known as component images. For instance, the component images in a synthetic full backup are the previous full image and the subsequent incremental images. A typical NetBackup backup process accesses the client to create a backup. A synthetic backup is a backup image created without using the client. Instead, a synthetic backup process creates a full or a cumulative incremental image by using previously created backup images called component images. In the synthetic backup workflow, images are fetched from different source storage units, synthesized, and copied to a target storage unit.

The hosts that come into the picture are source media servers and target media server from the same domain.

Table: DTE mode is OFF in the image

Global DTE mode

All NetBackup media server 9.1 and later with DTE mode

Any NetBackup media server earlier than 9.1

On

Off

Preferred Off

Data is not encrypted

Data is not encrypted

Data is not encrypted

Preferred On

Data is encrypted

Data is not encrypted

Data is not encrypted

Enforced

Data is encrypted

Operation fails

Operation fails

Table: When DTE mode is On for any one of the images and media server DTE setting is On

Global DTE mode

Host

Value of the DTE_IGNORE_IMAGE_MODE configuration option

NEVER (default)

WHERE_UNSUPPORTED

ALWAYS

Preferred Off

All NetBackup media server 9.1 or later

Data is encrypted

Data is encrypted

Data is not encrypted

Any NetBackup media server earlier than 9.1

Operation fails

Data is not encrypted

Data is not encrypted

Preferred On

All NetBackup media server 9.1 or later

Data is encrypted

Data is encrypted

Data is encrypted

Any NetBackup media server earlier than 9.1

Operation fails

Data is not encrypted

Data is not encrypted

Enforced

All NetBackup media server 9.1 or later

Data is encrypted

Data is encrypted

Data is encrypted

Any NetBackup media server earlier than 9.1

Operation fails

Operation fails

Operation fails

Note:

If DTE_IGNORE_IMAGE_MODE is set to ALWAYS, the DTE decision is as per the table - Table: DTE mode is OFF in the image.

Table: When the image DTE mode is On and the media server DTE setting on 10.0 or later is Off

Global DTE mode

Value of the DTE_IGNORE_IMAGE_MODE configuration option

NEVER (default)

WHERE_UNSUPPORTED

ALWAYS

Preferred Off

Operation fails

Operation fails

Data is not encrypted

Preferred On

Operation fails

Operation fails

Data is not encrypted

Enforced

Operation fails

Operation fails

Operation fails

Note:

If DTE_IGNORE_IMAGE_MODE is set to ALWAYS, the DTE decision is as per the table - Table: DTE mode is OFF in the image.

Note:

Feedback

Was this page helpful?
Previous

Duplication

Next

Verify

Feedback

Was this page helpful?