The 3-2-1 backup rule for normal people

Every backup guide eventually mentions the 3-2-1 rule, usually in a tone that suggests you should already know it. Here it is without the tone.

Keep three copies of anything you care about. Store them on at least two different kinds of storage. Keep at least one of them somewhere other than where you are.

That is the whole rule. The rest of this article is about what it means in practice for someone with a laptop, a phone, maybe an external drive and a cloud storage account.

Why three copies

One copy is not a backup. It is just the file. If the laptop is stolen, it is gone.

Two copies feels safe, and it is much better than one. But the failure that catches people is when the second copy fails at the same time as the first, or when you discover the second copy was quietly broken all along. An external drive that has been in a drawer for two years may or may not spin up. A sync folder that stopped syncing in March may not have anything newer than March.

Three copies means that for you to lose the file, three separate things have to go wrong at once. That almost never happens by accident.

Why two kinds of storage

“Kinds” here means different ways of storing, not different brands. Two external hard drives from the same shop, bought the same day, are one kind of storage. They share the same weaknesses: both can be dropped, both can be stolen from the same bag, both can be fried by the same power surge.

A laptop drive plus an external drive is two kinds. A laptop drive plus cloud storage is two kinds. The point is that whatever kills one copy should not be able to kill the other in the same way.

Why one copy off-site

Off-site means a different building. Not a different room. Not a drawer downstairs.

The failures this protects against are the ones that take out everything in a location at once: fire, flood, burglary, a dropped bag with the laptop and the backup drive in it. These feel unlikely until they happen, and when they do happen they are the ones that take years of photos, not an afternoon of work.

For almost everyone, the practical off-site copy is cloud storage. It is in a different building by definition, you cannot forget to take it with you, and it does not need to be plugged in.

A 3-2-1 setup that takes an afternoon

Here is a setup that satisfies the rule and costs very little effort to maintain.

Copy 1: the originals on your laptop or desktop. This is where you work. It counts as one of the three.

Copy 2: an external drive that you plug in once a week and copy your main folders to. Most operating systems have a built-in backup tool that will do this automatically whenever the drive is connected. Use it. A 2 TB external drive is cheap and will hold most people’s entire digital life.

Copy 3: cloud storage in a different building, which is to say anywhere. Upload the folders you would be upset to lose. With Onlinedrive this is a matter of dragging the folders into the browser; large uploads are resumable, so a big first upload can run overnight and survive the Wi-Fi dropping.

Count it up: three copies (laptop, external drive, cloud), two kinds of storage (local disks and cloud), one off-site (the cloud copy). Done.

What to actually back up

Trying to back up everything is how people end up backing up nothing. Start with the things that are irreplaceable, then the things that are expensive to recreate, and stop there.

Irreplaceable:

• Photos and personal video
• Scans of documents: passports, certificates, contracts, insurance
• Anything you wrote or made that exists nowhere else

Expensive to recreate:

• Tax records and accounts for the last seven years
• Client work and deliverables
• Password manager exports and two-factor recovery codes (stored carefully; see below)

Not worth it:

• Applications, which can be reinstalled
• Downloads you could download again
• Anything already in a service that keeps its own history, such as email

For most people this comes to somewhere between 50 GB and 500 GB. The pricing page is organised around exactly that range; the 250 GB and 500 GB plans exist because that is what a careful individual’s irreplaceable files tend to add up to.

Mistakes that make a backup worthless

Never testing a restore. A backup you have never restored from is a hope, not a backup. Once a quarter, pick a file at random, pretend you have lost it, and get it back from each copy. If any copy fails this test, fix it that day.

Syncing deletions. Some sync tools mirror your folder exactly, so when you delete a file locally it vanishes from the copy too. That is convenient and it is not a backup. Cloud storage with a Trash that holds deleted files and lets you restore them gives you a buffer; so does keeping your external drive as a plain copy rather than a mirror.

Keeping the external drive plugged in permanently. If it is always connected, a power surge, a theft or ransomware can take it out with the laptop. Plug it in to back up, then unplug it.

Putting the recovery codes in the thing they recover. Your two-factor recovery codes for your cloud account should not live only inside that cloud account. Print them, or put them in your password manager.

Only backing up the laptop. Phones hold most people’s photos now. Make sure your phone photos end up somewhere that is included in the three copies, whether that is by uploading them through the browser on the phone or by syncing them to the laptop first.

Adapting it for a small business

The rule does not change for a business, but the stakes do, and a few extra habits are worth it:

• Decide who is responsible for the weekly external drive backup. “Everyone” means no one.
• Keep client files in a team workspace rather than one person’s personal drive, so the copy does not disappear when they leave.
• Write down where the three copies are and how to restore from each. One page is enough. Put it somewhere the second-most-senior person can find it.
• If you handle other people’s personal data, pick a cloud region that matches where those people are. There is more on that in Why the region your files live in matters.

One thing to do today

Do not try to build the whole setup now. Pick the single folder you would be most upset to lose, and make sure it exists in two places by tonight. Dragging it into a cloud drive counts. The free 1 GB plan at /register is enough for documents; photos will need more, and you can decide about that once the first folder is safe.

Then put a recurring reminder in your calendar for the external drive. The rule is simple. Remembering to follow it is the hard part.