Computer Backup Strategy: 3-2-1 Plus Real History

The rule, and the part everyone drops

CISA states the rule plainly: “3 copies of important files, 2 different types of storage media (like a hard drive and the cloud), 1 copy stored off-site.” It also advises to “leverage protections for backups, including physical security, encryption and offline copies” and to “choose a backup solution that runs automatically and regularly.”

The instruction most often ignored is the testing one: verify you “can rapidly restore data both fully and partially, and…roll back data at least seven days if needed.” That sentence quietly rules out an entire class of setups. Rolling back seven days requires versioned history, not a current copy — and it is the requirement that defends against the two failure modes that actually destroy data: ransomware encryption and silent corruption, both of which propagate to any mirror before anyone notices.

So a computer backup strategy has four properties, not three: multiple copies, multiple media, one off-site, and enough version history to go back past the moment things went wrong.

Sync is not backup

Cloud sync folders are the most common thing people mistake for a backup, and the distinction is exact. Sync propagates changes. Backup preserves states.

If a file is encrypted by malware, sync faithfully uploads the encrypted version. If you delete a folder, sync deletes it everywhere. If an application corrupts a document on save, sync distributes the corruption to every device within seconds. The mechanism is working correctly in all three cases; it simply is not a backup.

Sync services frequently include a version history feature, and where they do it can serve as one layer — but check the retention window, check whether it covers deletions as well as edits, and check whether it applies to every file type. A thirty-day window is a useful backup layer; a seven-day recycle bin is not.

RAID is not backup either

Redundant drives protect against one specific failure: a drive dying. They protect against nothing else. Accidental deletion, ransomware, file corruption, theft, fire, flood, a failed controller and a mistaken command all affect every drive in the array simultaneously, because the array’s entire purpose is to keep the copies identical.

RAID is an availability feature. It keeps you working through a disk failure. Treat it as uptime insurance and keep a real backup alongside it — the two solve different problems and neither substitutes for the other. A computer backup strategy that counts the array as a copy has counted one copy twice.

Building the three copies

Two details make this work rather than merely exist. The local copy should not stay permanently mounted and writable if you can avoid it, because anything that can reach it can encrypt it — this is the reasoning behind CISA’s mention of “offline copies.” And the off-site copy should be encrypted before it leaves your control, so that the storage provider holds ciphertext.

Automation is non-negotiable. A manual computer backup strategy is a strategy that is current the week you set it up and three months stale by the time you need it.

Beyond files: settings and licenses

Most people back up documents and photos and then spend two days rebuilding a machine anyway, because the slow part of recovery is not the files. Keep a short written record of:

• Software licenses and account emails for anything you paid for.
• Application settings and configuration files for tools you have customized heavily.
• Browser profiles and bookmarks, if they are not already synced.
• Two-factor recovery codes, stored offline — losing these is worse than losing files, because they gate access to everything else.
• A list of installed applications, which turns a reinstall from archaeology into a checklist.

A full disk image is the alternative for anyone who cannot afford rebuild time. It restores the whole machine, settings included, and it complements file backups rather than replacing them.

The restore test

An untested backup is a hypothesis. The failure is common enough to be predictable: backups that silently stopped months ago, archives that will not open, encryption keys nobody kept, and cloud sets that turn out to have excluded the one folder that mattered.

Test twice a year, and test the two cases CISA names. Partial: restore a single file from roughly a week ago and open it. Full: restore a large folder to a different location and confirm it is complete and readable. If you keep disk images, verify one boots.

Write the date of the last successful test somewhere you will see it. Every subsequent claim you make about being backed up is only as good as that date.

The checklist

• Three copies, two media types, one off-site — and confirm which is which.
• Verify you can roll back at least seven days, not just restore today’s version.
• Stop counting sync as a backup unless it has a real version history window.
• Stop counting RAID as a backup. It is uptime insurance.
• Automate everything; manual backups decay.
• Encrypt the off-site copy before it leaves your control.
• Store two-factor recovery codes offline, separately from the vault they protect.
• Test a partial and a full restore twice a year and record the date.

That is the whole of a working computer backup strategy. It is unglamorous, it takes an afternoon to set up properly, and the only moment you will ever be glad of it is the moment when nothing else can help. For the equivalent process on a live site, see our website backup strategy.