Most people understand intellectually that they should back up their data. Far fewer do it consistently, and even fewer have tested whether their backups actually work. The moment you need a backup is the worst possible time to discover it doesn’t exist — whether the cause is ransomware, a failing hard drive, an accidental deletion, or a stolen laptop. For the bigger picture, our Complete Guide to Security and Privacy pulls everything together.
Backing up your data means building a system that runs automatically, stores copies in multiple locations, and has been verified to restore successfully before you need it under pressure.
The 3-2-1 rule — the foundation
The 3-2-1 backup rule is the standard framework that survives all four major threat categories: hardware failure, human error, malware (ransomware), and physical disaster.
The rule: keep 3 copies of your data (the original plus two backups), on 2 different media types (external drive and cloud), with 1 copy offsite (a cloud service or drive at a different physical location).
The most common practical implementation:
- Copy 1: original files on the primary computer
- Copy 2: external hard drive at home (local backup)
- Copy 3: cloud backup service (offsite)
Why this works: ransomware that encrypts the primary computer and the connected external drive doesn’t reach the cloud backup. A fire that destroys the computer and the external drive doesn’t reach the cloud. The cloud service going offline doesn’t affect the local copies. Each failure scenario leaves at least one surviving backup.
The 3-2-1-1-0 extension adds two refinements for higher-risk situations:
- 1 offline copy: a backup on a drive that is disconnected from the network and the computer when not actively in use — completely immune to ransomware
- 0 errors verified: a backup that has been tested and confirmed restorable
For personal use, the original 3-2-1 is sufficient. For critical business data or irreplaceable personal files, the offline copy and restoration test make it substantially more robust.
Automatic backups — the only approach that actually works
Manual backup processes fail because they depend on remembering to run them. A backup not updated in three months provides three-month-old data after a failure. Automation is not optional — it’s the only approach that works consistently over months and years.
Windows 11 built-in tools:
- File History (Settings → System → Storage → Advanced storage settings → Backup options → Add a drive): continuously backs up personal folders (Documents, Desktop, Pictures, Music, Videos) to an external drive every hour by default. Also keeps multiple versions of files — you can restore not just the current version but earlier ones, essential for recovering from accidental overwrites.
- System Image backup (Control Panel → System and Security → Backup and Restore → Create a system image): creates a complete snapshot including the operating system, installed applications, and settings. Allows complete restoration to bare metal after a drive failure, without reinstalling Windows from scratch. Run monthly and store on the external drive.
macOS built-in tools:
- Time Machine: System Settings → General → Time Machine → Add Backup Disk. Backs up the entire system continuously when an external drive is connected, with hourly snapshots that allow restoring to any point in the last 24 hours, daily backups for the past month, and weekly backups for previous months.
Cloud backup — the offsite copy
Cloud backup differs from cloud sync in an important way. Cloud sync (Dropbox, OneDrive, Google Drive) keeps files synchronised — if you delete a file on one device, it deletes from all devices. If ransomware encrypts your files, the encrypted versions sync to the cloud. Sync is not backup.
Cloud backup services maintain independent copies of files as they were at specific points in time, allowing restoration of files from before an encryption event, deletion, or corruption.
- Backblaze Personal Backup (~$99/year): unlimited storage, continuous backup of everything on the computer, 30-day version history on the free tier and up to 1 year on paid tiers. The simplest and most affordable cloud backup for most individuals.
- iDrive: backup for up to 5 computers, 5TB of storage, longer version history. Good for households with multiple devices.
- Microsoft OneDrive backup (included with Microsoft 365): automatically backs up Desktop, Documents, and Pictures folders. Limited to those folders but covers the most common data loss scenario. Version history in OneDrive preserves previous versions for 30 days (Recycle Bin recovery adds to this).
- Time Machine + iCloud Drive (Mac): iCloud Drive provides cloud storage that is not true backup, but combined with Time Machine for local backup it satisfies the offsite requirement if iCloud is enabled for Desktop and Documents folders.
Our guide on encrypting files on Windows 11 covers ensuring backup copies are themselves encrypted — especially important for cloud backups containing sensitive personal or financial documents.
Backing up mobile devices
iPhone: Settings → [your name] → iCloud → iCloud Backup → Back Up Now (enables automatic backup over WiFi when charging). Backs up photos, messages, app data, device settings, and Home Screen layout. Confirm the last backup time appears on the same page — “Backup not started” means photos and contacts are only on the device. For photos specifically, enable iCloud Photos (Settings → Photos → iCloud Photos) independently.
Android: Settings → Google → Backup → Back up now. This backs up app data, contacts, SMS, call history, and device settings. Photos require separate configuration — Google Photos: Settings → Back up → confirm backup is on.
Both the system backup and the photo backup on Android must be independently confirmed as active. “Backup not started” in either location means that content is at risk. A phone that’s lost or falls into water destroys both the device and any photos stored only on the device. Cloud backup for photos is the one backup most people have the strongest emotional regret over not having.
Verify and test your backups
The most dangerous backup is one you believe is working but isn’t. Backup software silently fails — a full drive, a lost connection, an interrupted process, or a configuration change that excluded important folders. Verification is not optional; it’s part of the backup strategy.
Monthly verification (5 minutes):
- File History: Control Panel → File History → check the last backup time (should be today or recent hours)
- Backblaze: system tray icon → check last backup time and any errors
- Cloud sync: open the service’s web interface and verify recent files match what’s on the local device
- Mobile: Settings → iCloud Backup / Settings → Google → Backup → confirm last backup time is within the past 24 hours
Annual restoration test (30 minutes): choose a sample of files from different folders and dates — documents, photos, a project folder — and practice restoring them from the backup. Browse the backup, select a file, and restore it to a test location. The restoration test reveals whether the backup is complete and whether you know how to use the recovery process before you need it under real pressure.
What to prioritise backing up
The operating system and applications are reinstallable — not requiring continuous backup (or handled through a periodic system image). Focus storage and bandwidth on what’s genuinely irreplaceable:
- Photos and videos — typically the data people feel the most acute loss over, and most at risk from a single-copy phone strategy
- Personal documents — tax records, contracts, medical documents
- Work files and project data
- Email archives (if stored locally rather than cloud-based)
- Creative work — music, writing, art, anything you made
| Data type | Priority | Best backup method |
| Photos and videos | Critical | Cloud photo backup + periodic external drive copy |
| Personal documents | Critical | File History + cloud backup service |
| Work files | Critical | File History + cloud backup + employer systems |
| OS and applications | Low (reinstallable) | Monthly system image is sufficient |
| Bookmarks and browser settings | Low | Browser sync (Chrome/Firefox sync accounts) |
For small business and freelance practice: the stakes are higher. Lost client files, financial records, or project deliverables carry liability consequences beyond personal inconvenience. Business data backup requires point-in-time recovery — the ability to restore to a specific past date, not just the most recent version — which dedicated backup services handle better than sync services. A small business not yet addressing backup comprehensively should prioritise this over most other technology investments: average data recovery cost from a failed drive far exceeds a decade of cloud backup subscription costs.
Back up your data with a system that runs automatically, stores copies in multiple locations, and has been tested to work. That combination — automation, redundancy, and verification — is what separates a backup strategy that will actually save you from a backup strategy that feels like one but fails at the moment it matters.
Ransomware-specific backup considerations
Ransomware is the backup threat that has changed most dramatically in recent years. Modern ransomware is designed specifically to find and encrypt backup files — it searches connected drives, network shares, and even some cloud sync services before triggering encryption. Understanding what this means for backup strategy:
- External drives that stay connected: a permanently connected external drive is accessible to ransomware. When ransomware encrypts the main drive, it will encrypt the backup drive too. The external drive backup should be disconnected when not actively backing up, or rotation should be used (two drives, alternating connection).
- Cloud sync is not immune: if ransomware encrypts your files and the encrypted versions sync to Dropbox/OneDrive, the encrypted files replace the originals in the cloud. Version history is your recovery path — OneDrive retains 30 days of version history, Google Drive 30 days, Dropbox 180 days on standard plans. Recover the pre-encryption versions from the version history before they expire.
- True cloud backup is immune: services like Backblaze maintain independent copies that ransomware running on your computer cannot access or modify. The backup runs to Backblaze’s servers with no direct file system access for ransomware to exploit.
The 3-2-1 rule with an offline copy specifically exists for ransomware scenarios: a disconnected drive that ransomware can’t reach is the only local backup that provides genuine protection against sophisticated ransomware that searches for and encrypts connected backup drives before triggering the attack. You might also run into Protect Your Personal Data.
After data loss — recovery expectations
When data loss actually happens, knowing what to expect from recovery:
- File History recovery: Control Panel → File History → Restore personal files → navigate to the folder → select the version to restore → click the green restore button. Recovery of a single folder of files typically takes minutes.
- Backblaze recovery: log in to Backblaze web interface → Restore Files → browse files → select what to restore → choose to restore as a ZIP download or to a USB drive mailed to you ($189 for up to 8TB on USB). The “USB drive mailed to you” option matters for recovering large archives when download bandwidth is the bottleneck.
- System image recovery: for a complete system failure — boot from Windows installation media → Repair your computer → Advanced options → System Image Recovery → select the backup → follow the wizard. Takes 30 minutes to several hours depending on drive size.
- Drive failure without backup: professional data recovery (Ontrack, DriveSavers) costs $500–$3,000+ depending on the type of failure and storage size. Success is not guaranteed. This is the scenario that motivates backup strategy more than any description of it.
Building the backup habit — practical starting points
For people who currently have no backup in place, the priority order for getting started without becoming overwhelmed:
- Today: enable iCloud Backup or Google Backup on your phone — this takes 3 minutes and protects the data most people care about most (photos)
- This week: sign up for Backblaze ($99/year) and install it — it runs automatically from that point
- This month: buy an external hard drive and set up Windows File History or Time Machine for local backup
- Quarterly: verify backup timestamps are current and run a small restoration test
These four steps implement the 3-2-1 rule without requiring a single session to complete everything. Each step is independent and provides immediate improvement over no backup — partial backup implementation is dramatically better than waiting for perfect implementation that never happens. Related: Data Loss Prevention.
The best backup strategy is the one that actually runs. A simple, automated setup that you don’t need to think about provides far more protection than a theoretically comprehensive system that requires manual maintenance and therefore gets neglected. Automation, redundancy, verification: those three properties determine whether a backup system actually protects you. If this sounds familiar, Biometric Data Privacy is worth a look.
