Hard drives die. Phones get stolen. Ransomware encrypts everything it touches. The 3-2-1 backup strategy is the simplest rule that protects you against all of it — and it takes less effort to set up than most people expect.
What the 3-2-1 Rule Means
- 3 copies of your data — the original plus two backups. One copy is no backup at all; if your only backup drive fails the same week as your laptop, you’re done.
- 2 different storage media — for example, an external hard drive and cloud storage. Different media fail in different ways, so a single failure mode can’t wipe everything.
- 1 copy offsite — stored somewhere physically separate from the originals. Fire, flood, burglary, or ransomware on your home network can’t reach a copy that isn’t there.
Why Each Part Matters
Three copies protect against the most mundane disaster: hardware failure. Drives have a limited lifespan, and failures cluster around the worst moments. Two media types protect against correlated failures — a power surge that fries your computer and the USB drive plugged into it, for instance. One offsite copy protects against catastrophe: the house fire, the break-in, and increasingly, ransomware that hunts down every connected drive on your network before revealing itself.
A Practical 3-2-1 Setup for Home Users
- Copy 1 — your device. Your laptop or phone holds the originals.
- Copy 2 — an external drive. A USB hard drive or SSD with automatic backup software (Windows File History, macOS Time Machine, or a free tool like Veeam Agent). Plug it in weekly — or leave it connected and let the software run nightly. Disconnect it when not backing up so ransomware can’t reach it.
- Copy 3 — the cloud, offsite. A cloud backup service or even a synced folder (Google Drive, OneDrive, iCloud) holds the offsite copy. For irreplaceable files — family photos, documents — this is the copy that survives the house fire.
Total cost: one external drive and possibly a few dollars a month for cloud storage. Total time after setup: essentially zero, because automation does the work.
What to Back Up (Priority Order)
- Irreplaceable personal files — photos, videos, personal documents. These can never be re-downloaded.
- Important records — tax documents, contracts, IDs, financial statements.
- Your password manager vault — export an encrypted backup periodically and store it with your other backups.
- Everything else — app data, game saves, downloads. Nice to have; back it up if space allows.
Backups vs. Ransomware
Backups are your only reliable defense against ransomware — paying the ransom funds criminals and often doesn’t restore your files anyway. But ransomware actively seeks out backups: it encrypts connected USB drives and mapped network shares. That’s why the offsite copy (or a disconnected drive) is non-negotiable, and why backup software with versioning matters — it keeps older file versions, so even if an encrypted file gets backed up, you can roll back to the clean version.
Test Your Backups
A backup you’ve never restored from is a hope, not a plan. Once a quarter, restore a random file from each backup location and confirm it opens. Check that your backup software reports successful runs — silent failures are the classic way people discover their “backups” stopped working a year ago. And keep your backup drive’s encryption password somewhere safe (your password manager, fittingly).
Automate Everything — or It Won’t Happen
Manual backups fail because humans forget. The people with reliable backups all have one thing in common: they automated it. Set your backup software to run on a schedule — nightly is ideal for active work, weekly at minimum — and configure it to back up the folders that matter (Documents, Photos, Desktop) rather than the entire drive, which wastes time and space on files you could simply reinstall.
Cloud backup tools shine here: once configured, they sync continuously in the background with zero effort from you. For the external-drive copy, leave the drive connected if your software supports scheduled runs, or set a recurring phone reminder to plug it in every Sunday evening. Check the backup log after the first scheduled run to confirm it actually worked — then trust the automation. The best backup strategy is the one that runs while you’re thinking about anything else.
One caution about automation: scheduled backups of an infected machine can copy encrypted files right over the good ones — which is why versioning matters more than frequency. Make sure your tool keeps at least a few weeks of file history, not just the latest copy, so you can always roll back to before the damage happened.
The Bottom Line
Data loss isn’t a question of if but when — and when it happens, the people who shrug are the ones who followed 3-2-1. Three copies, two media, one offsite. Set it up once, automate it, test it occasionally, and never think about it again.
About the Author
