The 3-2-1 backup rule — a simple rule against data loss

The 3-2-1 rule says: 3 copies of your data, on 2 different types of storage, with 1 copy off-site. Follow it and you’ll survive a disk failure, a stolen laptop, a fire at home, and ransomware. Here’s how to set it up in practice, for a household and for a business.

Why not just one backup

One folder on your computer is not a backup. An external disk that stays plugged in and sits next to the computer isn’t good protection either. Ransomware can encrypt connected disks and network storage in seconds. A fire or a burglary takes both copies at once.

The 3-2-1 rule addresses three kinds of risk at the same time:

• Hardware failure (the disk dies) → the second copy is on a different medium
• Human error (you delete or overwrite something) → cloud storage with versioning brings the old version back
• Disaster or attack (fire, theft, ransomware) → the third copy is off-site

3 copies

The original + 2 independent backups. The key word is “independent” — a copy on the same disk, or a cloud that syncs (Dropbox, OneDrive), is not enough. Sync is not a backup:

• If you delete a file in Dropbox, it’s deleted on every device
• If ransomware encrypts files in a synced folder, the encrypted versions sync up to the cloud too
• Without versioning, you lose the previous state

A real backup can bring a file back as it was a week ago, a month ago, a year ago.

2 different media types

The point is resilience against the same failure. If you have two copies on the same type of disk from the same batch, the chance that both fail at once is higher than you’d think.

Media types:

• HDD — cheap, large, but mechanical, sensitive to drops, and ageing
• SSD/NVMe — fast, drop-resistant, but pricier, and when one fails it loses everything at once (no warning clicks)
• NAS (Synology, QNAP) — home network storage with RAID redundancy
• Cloud (Backblaze, OneDrive, Google Drive, iCloud, pCloud) — geographically distant, with versioning
• Optical media (Blu-ray M-DISC) — for long-term archiving of documents, not for daily backups

For 3-2-1 we typically combine: a local disk + cloud, or a NAS + cloud.

1 copy off-site

An off-site backup saves you from physical disasters and from ransomware. Options:

• A cloud service (simple, automatic, encrypted): Backblaze (~5 USD/month, unlimited), OneDrive 1 TB in Microsoft 365, Google One, iCloud+, pCloud Lifetime
• An external disk at a relative’s place or at work (an offline copy): you take it over once a month and back up off-site
• An encrypted disk in a safe or a bank : for your most important documents

Off-site doesn’t have to be online. What matters is that it isn’t physically in the same place as the primary computer.

A practical setup for a household

Minimal setup (a one-off purchase plus a small monthly cloud fee):

1. Original: the files on your computer
2. Local backup: an external HDD/SSD (1-2 TB) that you connect once a week and run a backup to. After the backup, disconnect it from the computer. You can use Windows’ built-in “File History” or the free Macrium Reflect Free (which backs up whole-disk images).
3. Off-site backup: a cloud with versioning for what matters most (documents, photos). Microsoft 365 Personal includes 1 TB of OneDrive.

Frequency:

• Daily, or after finishing important work — sync to the cloud (Documents, Pictures)
• Weekly — a full disk image to the external HDD
• Monthly — check that the backup actually contains what it should

A practical setup for a small business

Recommended setup:

1. Original: files on a company server or workstations
2. Local backup: a Synology or QNAP NAS with at least 2 disks in RAID 1 (mirroring)
3. Off-site backup: a cloud service with versioning (Backblaze B2, Microsoft Azure Backup, AWS Glacier). Backblaze B2 runs at roughly 6 USD per TB/month.

Frequency:

• Daily, automatically — incremental backup of working data to the NAS
• Weekly, automatically — NAS → cloud replication
• Monthly, manually — a restore test (actually try restoring a single file from the cloud)

For businesses with accounting or databases, it’s important that the databases are backed up in a consistent state (not just the files) and that backups are encrypted (data protection).

The restore test — the most important part

The most important question in backups isn’t “am I backing up?”, it’s “can I restore?”.

A backup nobody has ever tried to restore is just a good feeling. It has happened to many companies: they paid for backup software for years, the backups ran every night, the lights were all green — and when the day came to restore after ransomware, they found the backups were corrupt, incomplete, or encrypted by the same attack.

A restore test at least once every 3 months:

1. Pick a random file from the backup
2. Restore it to a completely different location (don’t overwrite the original)
3. Open it and check that the contents are correct

For businesses: once a year, a full restore test — restore the entire server to spare hardware and verify that everything works.

Protection against ransomware

Ransomware can encrypt:

• Local disks and partitions
• Connected external disks
• Network storage (mapped drives, a NAS over SMB)
• Synced clouds without versioning

What ransomware can’t do:

• Touch a disk that isn’t physically connected
• Touch a cloud with immutable versioning (backups that can’t be overwritten or deleted for a set period)
• Touch a snapshotted NAS (Synology Snapshot Replication)

That’s why 3-2-1 works: one copy is always out of the attack’s reach.

What to back up, and when

Not everything matters equally:

When you need help

If something has already happened (deleted data, a failed disk, ransomware), stop using the disk immediately — every further write reduces the chance of recovery. Specialist data-recovery work is delicate, and a professional has tools and clean-room procedures that are hard to reproduce at home. But the best protection is the one you set up before anything goes wrong: a working 3-2-1 setup with a restore test you’ve actually run.