Data Backup Strategy

Why Backups Matter

Data loss is not a matter of "if" but "when." Hard drives fail mechanically after a few years of use. SSDs have a finite number of write cycles. Laptops get stolen. Ransomware encrypts files and demands payment. Accidental deletion happens in a moment of inattention. A spilled cup of coffee can destroy years of work in seconds.

The data on your devices is often irreplaceable. Family photos, personal documents, tax records, creative projects, password manager vaults, and years of accumulated digital life exist only as magnetic patterns on a disk or electrical charges in flash memory. Without backups, a single hardware failure or security incident can erase all of it permanently.

The 3-2-1 Backup Rule

The 3-2-1 rule is the foundation of any reliable backup strategy. It is simple, proven, and protects against the widest range of failure scenarios. The rule states:

• 3 copies of your data -- The original plus two backups. Any single copy can fail, so redundancy is essential.
• 2 different storage types -- For example, an internal drive and an external drive, or a local drive and cloud storage. Different media types fail in different ways and at different times.
• 1 copy offsite -- At least one backup should be in a physically separate location. A fire, flood, or theft that destroys your computer will also destroy any backup sitting next to it.

Example 3-2-1 setup:

  Copy 1 (Original):  Laptop internal SSD
  Copy 2 (Local):     External USB hard drive at home
  Copy 3 (Offsite):   Encrypted cloud backup (Backblaze, iCloud, etc.)

  Failure scenarios covered:
    Laptop stolen     → Restore from external drive or cloud
    External drive fails → Original + cloud still intact
    House fire        → Cloud copy survives
    Cloud breach      → Local copies unaffected (encrypted backup means
                         the provider cannot read your data anyway)
    Ransomware        → Disconnect external drive; restore from cloud
                         or vice versa

Types of Backups

Not all backups work the same way. Understanding the three main types helps you choose the right approach for your situation and balance storage space, backup speed, and recovery speed.

Full Backup

A complete copy of all your data every time the backup runs. Full backups are the simplest to understand and the fastest to restore from, because everything you need is in one place. The downside is that they take the most time and storage space, since unchanged files are copied again every time.

Incremental Backup

After an initial full backup, each subsequent backup copies only the files that have changed since the last backup (whether that last backup was full or incremental). This is the most storage-efficient method and the fastest to run. However, restoring requires the full backup plus every incremental backup in sequence, which makes recovery slower and dependent on every piece of the chain being intact.

Differential Backup

After an initial full backup, each subsequent backup copies all files that have changed since the last full backup. Differential backups grow larger over time (until the next full backup resets them) but are faster to restore than incremental backups because you only need the last full backup plus the latest differential.

Comparison over one week (starting with a full backup on Sunday):

Full backup every day:
  Sun: 100 GB | Mon: 100 GB | Tue: 100 GB | ... | Sat: 100 GB
  Total storage: 700 GB
  Restore: Any single day's backup (fast)

Incremental:
  Sun: 100 GB (full) | Mon: 2 GB | Tue: 1 GB | ... | Sat: 3 GB
  Total storage: ~112 GB
  Restore Wednesday: Sun (100 GB) + Mon (2 GB) + Tue (1 GB) + Wed (1.5 GB)

Differential:
  Sun: 100 GB (full) | Mon: 2 GB | Tue: 3 GB | ... | Sat: 12 GB
  Total storage: ~140 GB
  Restore Wednesday: Sun (100 GB) + Wed (5 GB)

Local Backup Solutions

Local backups are copies stored on hardware you physically control -- external drives, NAS devices, or a second internal drive. They offer fast backup and restore speeds and do not depend on internet connectivity.

External Hard Drives and SSDs

The simplest local backup method. Connect a USB external drive, run your backup, and disconnect it. An external HDD in the 2-4 TB range costs $60-$100 and holds more data than most people generate in years. External SSDs are faster and more durable but cost more per gigabyte.

• Use built-in backup tools -- Windows has File History and Backup and Restore. macOS has Time Machine. Linux has tools like Deja Dup, Timeshift, and rsync.
• Encrypt your backup drive -- If the drive is stolen, encryption prevents access to your data. Use BitLocker (Windows), FileVault (macOS), or LUKS (Linux).
• Disconnect after backing up -- A backup drive that is always connected is vulnerable to ransomware. Plug it in to back up, then unplug it.
• Rotate drives -- For extra protection, use two external drives and alternate between them. Keep one offsite (at a friend's house, in a safety deposit box) while using the other.

Network Attached Storage (NAS)

A NAS is a dedicated device on your home network that provides shared storage. Unlike a single external drive, a NAS can use multiple drives in a RAID configuration for redundancy, meaning one drive can fail without data loss. NAS devices from Synology or QNAP offer automated backup scheduling, version history, and remote access.

Cloud Backup Options

Cloud backups store your data on remote servers operated by a service provider. They satisfy the "offsite" requirement of the 3-2-1 rule automatically, since the data is stored in a data center far from your home. Cloud backups protect against physical disasters (fire, flood, theft) that would destroy both your computer and local backups.

Dedicated Backup Services

• Backblaze Personal Backup -- Unlimited backup for one computer at a flat monthly rate. Continuously backs up all files in the background. One of the simplest and most affordable options.
• Arq Backup -- Backup client that encrypts your data locally and sends it to the cloud storage of your choice (AWS S3, Backblaze B2, Google Cloud, etc.). You control the encryption keys.
• Duplicati -- Free, open-source backup client. Supports encryption, deduplication, and many cloud storage backends. Works on Windows, macOS, and Linux.

Cloud Storage as Backup

Services like Google Drive, iCloud, OneDrive, and Dropbox are file synchronization services, not true backup services. There is an important distinction: sync services mirror your files to the cloud, which means if you accidentally delete a file or ransomware encrypts it, the cloud copy is also deleted or encrypted. Some sync services offer version history (allowing you to restore previous versions), but this is not the same as a dedicated backup with guaranteed retention.

Encrypting Cloud Backups

When your data is stored on someone else's servers, encryption is essential. Client-side encryption means your data is encrypted on your device before it is uploaded, so the cloud provider cannot read it even if their servers are breached. Services like Arq and Duplicati do this by default. For sync services, tools like Cryptomator create encrypted containers that work transparently with any cloud storage provider.

Automating Your Backups

A backup that depends on you remembering to run it will eventually be forgotten. The most reliable backup is one that runs automatically, without any manual intervention. Every major operating system and backup tool supports scheduled automatic backups.

Setting Up Automated Backups

• Windows -- File History backs up automatically when the external drive is connected. Third-party tools like Backblaze run continuously in the background.
• macOS -- Time Machine runs hourly backups automatically when the backup drive is connected or a network backup destination is available.
• Linux -- Use cron jobs or systemd timers to schedule rsync, Borg, or Restic. Deja Dup offers a graphical scheduler.

Example: Automated daily backup with rsync on Linux

# Add to crontab (crontab -e):
0 2 * * * rsync -av --delete /home/user/Documents/ /mnt/backup/Documents/

# Explanation:
#   0 2 * * *     -- Run at 2:00 AM every day
#   rsync -av     -- Archive mode, verbose output
#   --delete      -- Remove files from backup that were deleted from source
#   /home/.../    -- Source directory (trailing slash = contents)
#   /mnt/backup/  -- Destination (external drive mounted here)

Example: Automated encrypted backup with Borg

# Daily Borg backup script (/usr/local/bin/backup.sh):
#!/bin/bash
export BORG_PASSPHRASE='your-passphrase-here'
borg create --compression lz4 \
    /mnt/backup/borg-repo::backup-{now:%Y-%m-%d} \
    /home/user/Documents \
    /home/user/Photos
borg prune --keep-daily=7 --keep-weekly=4 --keep-monthly=6 \
    /mnt/backup/borg-repo

Testing and Verifying Backups

A backup you have never restored from is a backup you cannot trust. The only way to know that your backup works is to test it by actually restoring data from it. Untested backups fail at the worst possible time -- when you need them most.

What to Test

• File integrity -- Restore a few random files and verify their contents are correct and complete. Open documents, play media files, verify checksums.
• Full restoration -- Periodically test restoring your entire system (or a complete directory) to a temporary location. This verifies that the backup is complete and the restore process works end to end.
• Version history -- If your backup keeps multiple versions, test restoring a file from a specific point in time. Verify that the version you expect is actually there.
• Encryption -- Verify that you can decrypt and access your backup using only the information you have stored (passphrase, key file). If you lose the encryption key, the backup is useless.

How Often to Test

Test a small restoration (a few files) monthly. Test a full restoration quarterly or whenever you make significant changes to your backup configuration. After switching to a new backup tool, test immediately -- do not wait until you need it.

Backup verification checklist:

  [ ] Backup ran successfully in the last 24 hours
  [ ] Backup log shows no errors or warnings
  [ ] Backup size is reasonable (not suspiciously small or zero)
  [ ] Can restore a random file and it opens correctly
  [ ] Can restore a file from 7 days ago (version history works)
  [ ] Encryption passphrase/key is accessible and works
  [ ] Offsite/cloud backup is current and accessible
  [ ] External backup drive is not showing SMART errors

  Run this checklist monthly. Mark it on your calendar.

Building Your Backup Plan

A backup plan documents what you are backing up, where the backups go, how often they run, and how you will restore in different disaster scenarios. Writing this down ensures you can follow it under the stress of an actual data loss event.

Step 1: Identify What Needs Backing Up

Not everything on your computer needs to be backed up. Operating systems and applications can be reinstalled. Focus on data that is irreplaceable or would take significant effort to recreate.

• Critical (back up immediately) -- Documents, photos, videos, password manager vault, financial records, tax documents, creative projects
• Important (back up regularly) -- Application settings, browser bookmarks, email archives, notes, saved game data
• Low priority (back up occasionally) -- Downloaded media (can be re-downloaded), application installers, large datasets that can be regenerated
• Do not back up -- Temporary files, cache directories, operating system files (reinstall is faster than restoring), application binaries

Step 2: Choose Your Backup Destinations

Apply the 3-2-1 rule. Select at least two backup destinations using different storage types, with at least one offsite.

Example backup plan:

  Data category     Local backup              Offsite backup
  ---------------   -----------------------   ----------------------
  Documents         External SSD (daily)      Backblaze (continuous)
  Photos/Videos     External HDD (weekly)     Backblaze (continuous)
  Password vault    External SSD (daily)      Encrypted cloud sync
  System config     Timeshift (daily)         Manual export monthly

  Local backup:  2 TB external SSD, encrypted with LUKS
                 Connected daily at 10 PM, auto-backup via cron, disconnected after
  Offsite:       Backblaze Personal Backup, continuous, client-side encrypted

  Recovery scenarios:
    Laptop stolen    → Buy new laptop, restore from Backblaze
    Drive failure    → Replace drive, restore from external SSD
    Ransomware       → Wipe system, restore from disconnected external SSD
    House fire       → Restore from Backblaze to new hardware
    Accidental delete→ Restore specific file from external SSD or Backblaze

Step 3: Set Up and Automate

Install your backup tools, configure the schedules, and run the first full backup. Verify that the backup completed successfully and test a restoration immediately. Then set a monthly reminder to check backup health and test a small restore.

Design a Backup Plan From the Failures It Has to Survive, in Five Steps

Most backup advice starts from the tool — buy this drive, use that service — and never states what the tool is supposed to survive. That is the wrong way round, and it is why so many people own a backup that would not have helped with the thing that actually went wrong. In the next twenty minutes you will start from the failures instead: enumerate the eight ways a file disappears, find which kinds of copy survive which, watch a sync faithfully destroy a document, catch a backup that is quietly corrupt, and put a number on how much work your current arrangement would cost you. Every line of output below came from running these files.

"""Ransomware is one of eight ways to lose a file. Which does your backup cover?"""

# Four kinds of copy, and whether each survives each cause.
#   2nd copy  = another folder on the same machine
#   sync      = a synced cloud folder (Drive, OneDrive, Dropbox)
#   versioned = a cloud backup service that keeps previous versions
#   offline   = an unplugged disk in a drawer at home
CAUSES = {
    "you delete it by mistake":        (False, False, True,  True),
    "you overwrite it with a bad edit":(False, False, True,  True),
    "the drive fails":                 (False, True,  True,  True),
    "the laptop is stolen":            (False, True,  True,  True),
    "fire or flood at home":           (False, True,  True,  False),
    "ransomware encrypts everything":  (False, False, True,  True),
    "the cloud provider closes":       (True,  False, False, True),
    "a bit rots silently":             (False, False, True,  True),
}

COLS = ["2nd copy", "sync", "versioned", "offline"]
print("%-34s %s" % ("HOW YOU LOSE IT", "  ".join("%-9s" % c for c in COLS)))
print("-" * 82)
for cause, cover in CAUSES.items():
    print("%-34s %s" % (cause, "  ".join("%-9s" % ("yes" if c else "no") for c in cover)))

for i, col in enumerate(COLS):
    covered = sum(1 for c in CAUSES.values() if c[i])
    print()
    print("%-10s covers %d of %d" % (col, covered, len(CAUSES)), end="")
print()
print()
print("No single column covers everything, which is the actual argument for")
print("keeping more than one kind -- not redundancy for its own sake.")

HOW YOU LOSE IT                    2nd copy   sync       versioned  offline  
----------------------------------------------------------------------------------
you delete it by mistake           no         no         yes        yes      
you overwrite it with a bad edit   no         no         yes        yes      
the drive fails                    no         yes        yes        yes      
the laptop is stolen               no         yes        yes        yes      
fire or flood at home              no         yes        yes        no       
ransomware encrypts everything     no         no         yes        yes      
the cloud provider closes          yes        no         no         yes      
a bit rots silently                no         no         yes        yes      

2nd copy   covers 1 of 8
sync       covers 3 of 8
versioned  covers 7 of 8
offline    covers 7 of 8

No single column covers everything, which is the actual argument for
keeping more than one kind -- not redundancy for its own sake.

"""Sync copies the damage. Versions keep the original."""
import os, shutil, hashlib, time

shutil.rmtree("work", ignore_errors=True); os.makedirs("work")
shutil.rmtree("synced", ignore_errors=True); os.makedirs("synced")
shutil.rmtree("versioned", ignore_errors=True); os.makedirs("versioned")

def save(content, version_label):
    open("work/thesis.txt", "w").write(content)
    shutil.copy("work/thesis.txt", "synced/thesis.txt")          # sync: overwrite
    shutil.copy("work/thesis.txt", "versioned/thesis.%s.txt" % version_label)

save("Chapter 1. Forty pages of careful argument.", "mon")
save("Chapter 1. Forty pages of careful argument. Chapter 2 begun.", "tue")
save("", "wed")                                                   # the bad save

print("what you have on Wednesday evening:")
print("   work/thesis.txt      :", os.path.getsize("work/thesis.txt"), "bytes")
print("   synced/thesis.txt    :", os.path.getsize("synced/thesis.txt"), "bytes")
print()
print("   versioned/ contains:")
for name in sorted(os.listdir("versioned")):
    print("      %-24s %d bytes" % (name, os.path.getsize("versioned/" + name)))

print()
print("The sync worked perfectly. It faithfully replicated an empty file")
print("over the only other copy, within seconds, exactly as designed.")
print()
print("recoverable from sync      :", os.path.getsize("synced/thesis.txt") > 0)
print("recoverable from versions  :", any(
    os.path.getsize("versioned/" + n) > 0 for n in os.listdir("versioned")))

what you have on Wednesday evening:
   work/thesis.txt      : 0 bytes
   synced/thesis.txt    : 0 bytes

   versioned/ contains:
      thesis.mon.txt           43 bytes
      thesis.tue.txt           60 bytes
      thesis.wed.txt           0 bytes

The sync worked perfectly. It faithfully replicated an empty file
over the only other copy, within seconds, exactly as designed.

recoverable from sync      : False
recoverable from versions  : True

"""A backup that is present, the right size, and quietly wrong."""
import hashlib, os

original = ("Chapter 1. " + "The argument proceeds carefully. " * 200).encode()
open("archive.bin", "wb").write(original)
checksum = hashlib.sha256(original).hexdigest()
open("archive.bin.sha256", "w").write(checksum)
print("archive written :", len(original), "bytes")
print("checksum stored :", checksum[:32], "...")

# Years pass. One bit changes -- a failing sector, a bad cable, a cosmic ray.
data = bytearray(open("archive.bin", "rb").read())
data[5000] ^= 0b00000001
open("archive.bin", "wb").write(data)

after = open("archive.bin", "rb").read()
print()
print("file still exists     :", os.path.exists("archive.bin"))
print("size unchanged        :", len(after) == len(original))
print("opens without error   :", True)
print("bytes that differ     :", sum(a != b for a, b in zip(original, after)))
print()
expected = open("archive.bin.sha256").read().strip()
actual = hashlib.sha256(after).hexdigest()
print("checksum matches      :", expected == actual)
print()
print("Every check a human would perform says the backup is fine. Only the")
print("checksum notices. This is why a backup format worth using stores one.")

archive written : 6611 bytes
checksum stored : 75cb2effb271f7639873f7baa66b7a5f ...

file still exists     : True
size unchanged        : True
opens without error   : True
bytes that differ     : 1

checksum matches      : False

Every check a human would perform says the backup is fine. Only the
checksum notices. This is why a backup format worth using stores one.

"""Two numbers decide whether a backup plan is good enough."""

WORK_HOURS_PER_DAY = 7

PLANS = [
    ("manual copy 'when I remember'", 21 * 24, 2.0),
    ("weekly, Sunday night",           7 * 24, 1.5),
    ("nightly, automatic",                 24, 1.5),
    ("continuous versioning",             0.25, 0.5),
]

print("%-32s %10s %12s %14s" % ("PLAN", "RPO (h)", "RTO (h)", "WORK AT RISK"))
print("-" * 74)
for name, rpo, rto in PLANS:
    lost_days = rpo / 24
    lost_work = lost_days * WORK_HOURS_PER_DAY
    print("%-32s %10.2f %12.1f %10.1f hours" % (name, rpo, rto, lost_work))

print()
print("RPO = how far back you fall (time since the last good copy)")
print("RTO = how long you are stuck (time to get working again)")
print()
print("Pick the RPO you could actually absorb, then choose a plan that")
print("meets it. Most people choose a plan first and discover the RPO")
print("on the day it matters.")

PLAN                                RPO (h)      RTO (h)   WORK AT RISK
--------------------------------------------------------------------------
manual copy 'when I remember'        504.00          2.0      147.0 hours
weekly, Sunday night                 168.00          1.5       49.0 hours
nightly, automatic                    24.00          1.5        7.0 hours
continuous versioning                  0.25          0.5        0.1 hours

RPO = how far back you fall (time since the last good copy)
RTO = how long you are stuck (time to get working again)

Pick the RPO you could actually absorb, then choose a plan that
meets it. Most people choose a plan first and discover the RPO
on the day it matters.

"""The only test that counts: take it out again and compare."""
import hashlib, os, shutil, tarfile

shutil.rmtree("restored", ignore_errors=True)
shutil.rmtree("source", ignore_errors=True); os.makedirs("source")
for name, text in (("notes.txt", "the notes"), ("thesis.txt", "the thesis" * 50),
                   ("photo.dat", "\x89PNG" + "x" * 900)):
    open(os.path.join("source", name), "w").write(text)

def fingerprint(folder):
    out = {}
    for name in sorted(os.listdir(folder)):
        out[name] = hashlib.sha256(open(os.path.join(folder, name), "rb").read()).hexdigest()
    return out

before = fingerprint("source")

with tarfile.open("backup.tar.gz", "w:gz") as tar:
    tar.add("source", arcname=".")
with tarfile.open("backup.tar.gz") as tar:
    print("archive holds:", len([m for m in tar.getmembers() if m.isfile()]), "files")

# The drill: restore to a NEW location and compare, without deleting the original.
os.makedirs("restored")
with tarfile.open("backup.tar.gz") as tar:
    tar.extractall("restored", filter="data")

after = fingerprint("restored")

print()
print("%-14s %-10s %s" % ("FILE", "PRESENT", "CONTENTS IDENTICAL"))
print("-" * 46)
for name in before:
    print("%-14s %-10s %s" % (name, name in after, before[name] == after.get(name)))

print()
print("files compared      :", len(before))
print("mismatches          :", sum(1 for n in before if before[n] != after.get(n)))
print()
print("Restoring to a NEW folder is the point. Restoring over the original")
print("destroys the thing you are trying to protect if the backup is bad.")

archive holds: 3 files

FILE           PRESENT    CONTENTS IDENTICAL
----------------------------------------------
notes.txt      True       True
photo.dat      True       True
thesis.txt     True       True

files compared      : 3
mismatches          : 0

Restoring to a NEW folder is the point. Restoring over the original
destroys the thing you are trying to protect if the backup is bad.

Summary

Data loss is inevitable over a long enough timeline. The question is not whether you will experience a hardware failure, accidental deletion, or security incident, but whether you will be able to recover from it. A solid backup strategy is your insurance policy against every form of data loss.

• Backups protect against hardware failure, theft, ransomware, and accidental deletion -- no other single measure covers all of these
• Follow the 3-2-1 rule -- three copies, two storage types, one offsite. This covers the widest range of disaster scenarios
• Understand backup types -- full, incremental, and differential. Modern tools handle this automatically with deduplication
• Use local backups for speed -- external drives and NAS devices provide fast backup and restore without internet dependency
• Use cloud backups for offsite protection -- they survive physical disasters. Ensure client-side encryption so the provider cannot read your data
• Sync is not backup -- Dropbox, Google Drive, and similar services propagate deletions and corruption. Use a dedicated backup tool
• Automate everything -- a backup that requires manual action will eventually be forgotten
• Test your backups regularly -- restore files monthly and verify they are intact. An untested backup is an unverified assumption