Backups: The 3-2-1 Rule and Restoring

Almost every digital disaster, whether it is a broken laptop, a flood, a stolen phone or ransomware, ends in the same question: do you have a copy? A good backup turns a catastrophe into an annoyance. In this lesson you will learn the 3-2-1 rule, set up a simple system that runs by itself, and, just as important, learn how to check that you can actually restore your data.

We have talked about backups several times already: as the best answer to ransomware in lesson 1.2, and as a companion to encryption in the last lesson. Now it is time to build one.

Why backups matter more than you think

Data can be lost in many ways, and most of them have nothing to do with hackers:

• Hardware failure: every drive eventually dies, often without warning.
• Loss or theft of a phone or laptop.
• Accidents: wrongly deleted folders, overwritten documents, a spilled drink.
• Disasters: fire, water damage, burglary (which takes the computer and the external drive next to it).
• Ransomware: files encrypted and held hostage, as we saw earlier.
• Account problems: a locked or hijacked online account, whose content you cannot access any longer.

An important distinction: synchronization is not a backup. A service that keeps a folder identical on several devices will also faithfully copy your mistakes: delete a file on one device, and it disappears everywhere; ransomware encrypts the files, and the encrypted versions are synchronized. A backup, on the other hand, keeps older versions that can be restored.

The 3-2-1 rule

The classic guideline for safe backups is easy to remember:

• 3 copies of your data: the original plus two backups.
• 2 different types of storage: for example your computer's drive plus an external drive, or an external drive plus an online service. This protects you against the failure of one technology.
• 1 copy kept off-site: away from your home, such as a cloud backup, a drive stored at a relative's house or at work. This protects you against fire, flooding and theft.

Think of it as not keeping all your keys on one ring. For many modern setups, a variation is also recommended: keep at least one copy offline or immutable, meaning disconnected from your computer or impossible to modify, so ransomware cannot reach it.

Deciding what to save

You do not need to back up everything with the same urgency. Sort your data into three groups:

• Irreplaceable: family photos and videos, personal documents, scanned papers, creative work, passwords and recovery information. Back these up first and most carefully.
• Hard to rebuild: your settings, your music library, your projects.
• Replaceable: the operating system and applications, which can be reinstalled.

Backup options

Option	Strengths	Limits
External drive (USB)	Cheap, quick, fully under your control	Can fail, be stolen along with the computer, or be encrypted by ransomware if it stays plugged in
Network storage at home	Automatic for several devices	Needs setup and care; still in the same building
Online backup service	Off-site by nature, automatic, keeps versions	Recurring cost; depends on the provider's security; choose encrypted storage
Drive stored elsewhere	Off-site, simple, offline	Requires regular manual swapping

Whatever you choose, encrypt your backups. A copy of your life on an unencrypted drive is a copy that a thief can read. Use the encryption feature of your backup tool or of the drive, and keep the password in your manager and on paper.

A simple plan for a family

1. Copy 1: the original files on your computer and phone.
2. Copy 2: an encrypted external drive, backed up automatically with your system's built-in backup tool each time you plug it in (weekly is a good start).
3. Copy 3: an encrypted online backup or a second drive kept at a relative's home and refreshed every month or two. Photos on your phone can be set to back up automatically to a cloud service, as long as you also keep the 3-2-1 approach for the originals.
4. Between backups, unplug the external drive when it is not in use, so that a ransomware infection cannot encrypt it.

The step everyone skips: test the restore

A backup that has never been tested is a hope, not a backup. Many people discover problems only when it is too late: an empty folder, a corrupted file, a lost password, a backup that stopped running months ago.

Every few months, run a restoration test:

1. Pick a few files at random, including a photo and a document.
2. Restore them from the backup to a different folder.
3. Open them and check that they are complete and readable.
4. Also confirm that you have the password or recovery key needed to open the backup, away from the computer that is being backed up.

And what about restoring after ransomware? First clean or reinstall the infected device, change the passwords of your accounts, and only then restore your files from a backup that predates the infection. Restoring onto a still-infected computer just gets you encrypted again.

Beyond the computer

• Phones: enable the built-in backup of your phone and photos, and know how to restore it onto a new device.
• Online accounts: most services let you export your data (mail, photos, contacts, documents). Do it from time to time for what matters most.
• Authenticator apps and passkeys: make sure you have recovery codes or a backup, otherwise a lost phone may lock you out of your accounts.
• Password manager: keep an exported or paper emergency copy as described in lesson 2.2.

Your turn

Exercise. Design your own 3-2-1 plan on paper: what you will save, where the three copies will be, which one is off-site, how it will be automated, and when you will test a restore.

See a solution

An example for a person with a laptop and a phone:

• What: Documents and Photos folders, scans of identity papers, exported password manager emergency copy.
• Copy 1: the laptop itself. Copy 2: an encrypted external drive, backed up each week by the system backup tool and stored unplugged. Copy 3 (off-site): an encrypted online backup service running daily, or a second drive at a relative's home updated monthly.
• Automation: scheduled weekly reminder on the calendar to plug in the drive; automatic daily cloud backup.
• Test: restore three random files on the first Sunday of every third month, and check that the recovery password is available on paper.

Add to your Security Notebook

Under "3. Devices", write your 3-2-1 plan in three lines, the date of your first backup and the date of your first restore test. Do the first backup this week.

The last device in your pocket is also the most personal: your smartphone. Let us look at its privacy settings in the final lesson of the chapter.