Set up 3-2-1 backups that actually restore

By the end of this guide, you'll have three copies of your important files, one of them away from your home or office, and you'll have proved you can get them back.

Who it's for

Individuals, home offices and small businesses with a few computers, and perhaps a small file server or NAS. Setting it up takes an afternoon; keeping it honest takes about fifteen minutes a month. You'll need an external drive (or a NAS) and either a cloud backup service or a second drive you can keep somewhere else.

The rule is simple: keep 3 copies of your data (the original plus two backups), on 2 different devices, with 1 of them offsite. A failed drive, a stolen laptop, a fire or a ransomware attack can each take out one copy, but it's very unlikely to take out all three.

Steps

1. Decide what you can't afford to lose

   List the data that matters and where it actually lives: documents, photos, accounting files, client records, email archives, and anything on a server or NAS. Check the less obvious places too, such as an accounting program's own database folder or an email archive file (for example an Outlook .pst).

   Note that file syncing (OneDrive, Dropbox, iCloud Drive, Google Drive) is not a backup on its own. If a file is deleted or encrypted by ransomware, the sync faithfully copies that damage everywhere. Their version history helps, but only for a limited time.

2. Copy 1: an automatic backup to a separate device

   Point your computer's built-in backup tool at an external drive or a NAS: Time Machine on a Mac, File History or Windows Backup on Windows. For a server, use a scheduled backup job. Set it to run automatically, at least daily. A backup you have to remember to start will eventually stop happening.

3. Copy 2: an offsite backup

   Choose one:

   • A cloud backup service that runs automatically, keeps old versions, and encrypts your data before it leaves your computer. This is the easiest option to keep going.
   • A second drive kept somewhere else, such as another office or a relative's home, swapped with a drive at home every week or two. It costs nothing to run, but depends on you doing the swap.

   If the backup is encrypted, store the encryption password or recovery key somewhere other than the computer being backed up, for example in a password manager and on paper in a safe place. Without it, the offsite copy can't be opened.

4. Keep enough history

   Problems are often noticed late: a file corrupted last month, or a folder deleted weeks ago. Make sure your backups keep older versions, for example daily versions for two weeks, weekly for two months and monthly for a year. Most backup tools let you set this.

5. Keep the backups out of ransomware's reach

   Ransomware encrypts every drive it can reach, including a backup drive that's always connected. So make sure at least one copy isn't reachable from your everyday computer: a drive that's unplugged when not in use, a cloud service that keeps versions you can't delete by accident, or a NAS the computer can only reach through the backup software, with its own separate password.

6. Test a restore, then make it a habit

   Restore a few files from each backup copy into a new folder, and open them. Put a reminder in your calendar to repeat this monthly, and once a year try restoring a whole folder, or a whole computer if you can. Also switch on your backup tools' notifications, so a failed or stalled backup doesn't go unnoticed.

Common mistakes

• Treating sync as backup. Syncing copies deletions and ransomware damage along with everything else. Keep a real backup alongside it.
• A backup drive that's always plugged in. Ransomware, a power surge or a thief can take the computer and the backup at the same time.
• Never testing a restore. Backups fail silently: a full drive, an expired subscription, a folder that was never selected. The restore test is the only way to know.
• Keeping the encryption key only on the computer. If that computer is lost, so is the key to the offsite backup.
• Forgetting data that lives elsewhere. Phones, and online services such as Microsoft 365 or Google Workspace, hold data too. The provider keeps its systems running, but deleted or overwritten files may be recoverable only for a limited time, so check what's covered.