What a backup is, and what it is not
A backup is a separate copy of your data that you can restore if the original is lost, damaged or changed by mistake. The word “separate” is the important part. A file that is synced between your laptop and another device is not necessarily a backup: if you delete or corrupt it on one side, the change usually spreads to the other.
Files can be lost in many ordinary ways: a spilled drink, a stolen bag, a failed drive, an accidental deletion, a software fault, a fire or flood, or ransomware that scrambles everything it can reach. A good backup strategy is designed around the idea that any single copy, or any single location, can fail.
The 3-2-1 idea
The 3-2-1 rule is a widely used way to remember the basics:
- 3 copies of your data. That means the original plus two backups.
- 2 different types of storage. For example, the computer’s internal drive and an external drive, or an external drive and an online service. If one kind of device fails in a particular way, the other is less likely to fail the same way.
- 1 copy offsite. At least one copy should be somewhere other than your home or office, so a fire, flood or theft that affects the building does not destroy every copy.
Some people extend this to variations that add an offline or unchangeable copy, which is explained below. The core rule is a good starting point because it is easy to remember and easy to check.
A simple example
Imagine a small design studio with its working files on a laptop (copy one). The studio plugs in an external drive each evening and copies the files to it (copy two, on a second kind of storage). It also uses an online backup service that uploads changes automatically (copy three, offsite).
If the laptop dies, the external drive holds recent files. If the office is burgled and both the laptop and the drive are taken, the online copy is still there. No single event wipes out everything.
Choosing where the copies live
Each option has trade-offs.
External drives are inexpensive and fast to restore from, but they can be lost, stolen, damaged or forgotten. Keep them somewhere separate from the computer when possible.
Network storage in the office can back up several computers at once. It is convenient, but if it sits on the same network and is always connected, malware that reaches your computers might reach it too, and it is still in the same building.
Online backup or cloud storage provides the offsite copy and often runs automatically. Restoring a large amount of data can take time depending on your connection. Check whether the service keeps older versions of files, as this protects against deleting or overwriting something and not noticing for a while. Remember that a plain file-sharing folder is not always a true backup, so read how the service handles deleted and changed files.
Physical media kept elsewhere, such as a drive stored at a trusted person’s home and swapped periodically, is a low-tech way to keep an offsite copy. It is only as current as your last swap.
Protecting backups from ransomware
Ransomware often tries to encrypt or delete backups it can reach. To reduce the risk:
- Keep at least one copy that is not permanently connected to the computer or network, such as an external drive that is unplugged after each backup.
- Look for versioning or “immutable” options in online services, which stop recent backups being altered or deleted for a set period.
- Protect backup accounts with strong, unique passwords and two-factor authentication.
- Keep your systems updated, since many attacks begin with a known flaw. The wider topic of security trends and threats applies here too.
No arrangement is a guarantee, but separation between your live data and at least one copy makes a big difference.
Decide what to back up and how often
You do not necessarily need to back up everything. Think about:
- What is irreplaceable? Customer records, financial data, contracts, photos and documents that exist nowhere else.
- What can be rebuilt? Applications can usually be reinstalled, although settings and licenses are worth noting down.
- How much work can you afford to redo? If losing a day of work would be painful, back up daily or continuously. If files rarely change, weekly may be enough.
This last question, how much data you can afford to lose, is closely related to disaster recovery planning, which also asks how long you can be without a system.
Encrypt where it matters
A backup drive contains the same sensitive information as the original. If it could be lost or stolen, use encryption so the contents are unreadable without a password, and store that password somewhere safe. Keep in mind that a lost encryption password can make the backup unusable, so record it in a password manager or another secure place.
Test your restores
Many people discover problems only when they need the backup. Once a quarter, or at least twice a year, try restoring a few files, ideally to a different location, and confirm they open and are current. Also check that the backup is actually running: automated jobs sometimes stop quietly after a software update, a full drive or a changed password.
A basic routine is:
- Check that the latest backup completed.
- Restore a sample of files and open them.
- Note the date and anything that needs fixing.
Common mistakes
- Treating a synced folder as the only backup.
- Keeping the “backup” drive plugged in next to the computer forever.
- Never checking that the backup is working.
- Forgetting phones, tablets and cloud-based accounts, which may hold important business data.
- Relying on one person who knows how the backup works.
The aim is not perfection. It is a routine that is simple enough to keep doing and that you have seen work at least once.