A hand connecting a portable hard drive to a laptop on a white desk.

Guides Recovery

Backups that actually save you

Most people have something they call a backup. Rather fewer have one that would survive the situation it exists for.

6 min read  ·  Last reviewed 11 August 2026  ·  Written for people looking after their own devices

The 3-2-1 rule 3 copies of the data 2 different kinds of storage 1 kept off-site or offline
A drive left permanently connected is a second copy, not a backup: ransomware looks for it and encrypts it along with everything else.

The rule worth remembering

Three copies of your data, on two different types of storage, with one kept off-site or offline. It is old advice because it keeps being right: it survives hardware failure, theft, fire and ransomware, which is more than any single copy manages.

Why a permanently connected drive is not enough

A backup drive left plugged in is visible to everything running on the machine, including ransomware, which deliberately looks for it. Sync folders have the same weakness in a different form: encrypt the local copy and the encryption is dutifully synced everywhere.

This is the difference between a backup and a second copy. A backup is one the problem cannot reach.

Versions matter as much as copies

If your backup only holds the current state, then a file corrupted or encrypted last Tuesday was backed up in that state. Keep version history long enough that you can go back to before the problem started - which means longer than it typically takes to notice.

What to back up

Documents, photos, anything you created. Also the things people forget: browser bookmarks, email if stored locally, password manager exports if you keep them, licence keys, and configuration you would hate to reconstruct.

The operating system and applications are usually not worth backing up. Reinstalling is often faster than restoring, and on a compromised machine it is the safer choice anyway.

Test it

Restore a file. Then, once a year, restore something larger. An untested backup fails at exactly the moment it is needed, and the failure is usually something mundane: an expired credential, a full disk, a job that stopped months ago without saying so.