/digitaldrive/images/Digital_Drive_logo.png){kind=logo}
Digital Drive
IT Solutions
Three copies. Two types of storage. One offsite. A simple strategy to protect what matters.
Imagine you've been doing everything right.
Your important documents, family photographs, and financial records are backed up to an external hard drive. You've even tested restoring a few files, and everything worked perfectly.
You're feeling pretty confident.
Then one night, a fire damages your home.
Your computer is destroyed.
Unfortunately, so is the external hard drive sitting right beside it.
Your backups worked. Your recovery tests worked.
But both copies of your information were lost in the same incident.
That's a problem many people don't consider until it's too late.
In our previous article, Your Backup Succeeded. But Can You Actually Recover?, we explored why having a backup doesn't necessarily mean you can restore your information.
Now we're going to look at the next question:
How do you protect your backups so they're still available when something goes wrong?
Fortunately, there's a straightforward strategy that's been used for years.
It's called the 3-2-1 Backup Rule.
And while the name might sound technical, the idea is surprisingly simple.
The 3-2-1 rule is a method of organizing your important information so that a single failure is less likely to destroy every copy.
It works like this:
That means your original files, plus two separate backup copies.
Not three backups. Three copies in total.
Keep your information on at least two different types of storage media, such as a computer's solid-state drive and an external hard drive.
The purpose is to reduce the chance that one type of storage failure will affect everything.
At least one backup should be stored somewhere other than the building where your original information is kept.
That might mean a secure offsite location or an appropriately configured cloud backup service.
Why?
Because a fire, flood, theft, or other disaster affecting one location shouldn't automatically destroy every copy of your information.
Three copies. Two storage types. One offsite.
That's the basic rule.
It isn't a particular piece of software or an expensive service you need to purchase.
It's simply a way of thinking about where your information lives and what might happen to it.
And that's the important part.
The goal isn't just to have more copies. It's to avoid losing them all for the same reason.
Let's start with something familiar.
Imagine you have a collection of family photographs stored on your computer.
Those photographs might represent years of memories.
Birthdays, holidays, family gatherings, and people who may no longer be with you.
Losing them could be devastating.
So you buy an external hard drive and copy your photographs onto it.
Excellent! You now have two copies.
But what happens if that external drive fails?
What if it's accidentally damaged or someone deletes its contents?
You're back to depending on the original computer.
This is why the 3-2-1 rule recommends having a third copy.
For example:
Copy 1: Your original photographs on your computer.
Copy 2: A backup on an external hard drive.
Copy 3: Another backup stored through a dedicated cloud backup service.
Now you have alternatives.
If your computer fails, you may be able to restore the photographs from the external drive.
If the external drive fails, there's still another copy available.
If something happens to your entire home, the offsite backup could preserve those memories.
Three copies aren't necessarily three independently protected copies.
Imagine keeping your photographs in three different folders on the same computer.
Technically, you've copied the files three times.
But if the computer's storage fails, all three folders could disappear together.
Or suppose all three copies are on drives permanently connected to the same computer.
They may be vulnerable to the same electrical problem or malicious software.
The number of copies matters, but so does how they're separated.
That brings us to the second part of the rule.
Computers store information in different ways.
Your laptop might use a solid-state drive (SSD). An external backup drive might use a traditional hard disk (HDD).
Other backup solutions may use different storage technologies or services.
The traditional 3-2-1 rule recommends using at least two types of storage media.
Why?
Because different storage technologies can have different failure characteristics.
But there's an equally important lesson here that doesn't require understanding how storage devices work.
Don't arrange your backups so that one problem can easily destroy all of them.
Consider these examples.
You save your important files in one folder and copy them into another folder on the same drive.
If that drive fails, both folders may be lost.
That's not meaningful protection against a drive failure.
You have two external drives connected to your computer.
That's better than having only one copy, but both drives may still be vulnerable if ransomware infects the computer or an electrical problem damages connected equipment.
The drives are physically separate, but they still share some risks.
Now imagine your original information is on your computer, one backup is on an external hard drive that's disconnected when not in use, and another backup is stored with a separate cloud backup service.
These copies are less likely to be affected by exactly the same problem.
That's the thinking we're aiming for.
Different storage types help, but genuinely independent protection matters too.
We don't need to become experts in hard drives, cloud infrastructure, or storage technologies to understand that principle.
Let's go back to our opening scenario.
Your computer contains your important information.
Your external hard drive contains a perfect backup.
Both are sitting in your home when a fire occurs.
Having two copies doesn't help much when both are destroyed together.
That's why the final part of the 3-2-1 rule requires at least one copy to be stored somewhere else.
An offsite backup might be:
An encrypted external drive stored securely at another location.
A backup stored in a properly secured remote facility.
A dedicated cloud backup service that keeps recoverable copies of your information.
The important thing is that the backup isn't exposed to the same physical disaster as your original computer.
Not necessarily.
Services such as OneDrive, Google Drive, and Dropbox can synchronize files between devices and cloud storage.
That's useful, and many provide recovery features.
However, synchronization doesn't automatically mean you have an independent backup.
If you accidentally delete a synchronized file, the deletion may also appear on your other devices.
If ransomware encrypts synchronized files, those changes may be uploaded too.
Some cloud services offer previous versions, deleted-file recovery, and other protections, but you need to understand what your service actually includes and how long those recovery options remain available.
A dedicated cloud backup and a cloud synchronization service aren't necessarily doing the same job.
The distinction isn't whether the information is stored in the cloud.
It's whether you can recover the information you need after something goes wrong.
There's another distinction worth understanding.
Offsite means stored somewhere other than your primary location.
Offline means disconnected from computers and networks when not needed.
An external drive stored in another building can be both offsite and offline.
A cloud backup is offsite, but it remains accessible through an online service.
That doesn't automatically make cloud backup unsafe. Properly secured cloud backup services can offer strong protection, including restricted access and versions that cannot easily be modified or deleted.
But it does mean that physical separation and protection against cyberattacks are different considerations.
Offsite protects against losing everything in one location. Offline or otherwise protected backups help reduce the risk of losing everything to one digital attack.
Ideally, your backup strategy addresses both.
It's easier to understand the rule when we apply it to everyday situations.
Suppose you want to protect your family photographs, personal documents, and financial records.
A practical arrangement might look like this:
Copy 1 — Your computer
Your original files are stored on the computer you use every day.
Copy 2 — An external hard drive
Backup software copies your important information to an external drive on a regular schedule.
When practical, you disconnect the drive after the backup completes.
Copy 3 — A dedicated cloud backup
Another backup service automatically preserves your important files at a separate location.
You verify that the service keeps recoverable versions and that you know how to restore them.
Now you have three copies, different storage arrangements, and a protected offsite copy.
If your computer fails, the local backup may allow a relatively quick recovery.
If the entire house is damaged, the cloud backup could still be available.
And if ransomware affects your computer, the disconnected drive or appropriately protected cloud recovery points may provide a usable alternative.
Notice that the backups serve slightly different purposes.
One provides convenient local recovery.
The other protects against a problem affecting the entire location.
Now consider a small business that relies on computers for customer information, accounting, invoices, and everyday operations.
Its backup arrangement might include:
Copy 1 — Working business information
The files, databases, and applications used throughout the day.
Copy 2 — Local backup storage
A dedicated backup device or system that allows important information to be restored without downloading everything from the internet.
Copy 3 — Protected offsite backup
A separate backup service or location where the information is preserved if the office or its local equipment is damaged.
For a business, there are additional questions worth asking.
Can the accounting application actually open its restored database?
Can authorized employees access the information?
Are software licenses and configuration details available?
How long would restoring the business take?
And what happens if the person who normally manages the backups isn't available?
These questions connect directly to our previous article about testing recovery.
Here's something the numbers 3-2-1 don't tell you.
How frequently should you make those copies?
The answer depends on how quickly your information changes and how much you can afford to lose.
Someone who occasionally adds family photographs might be comfortable with a less frequent backup schedule.
A business processing customer transactions all day may need much more frequent backups.
Imagine a business that creates dozens of invoices each day but only backs up its information once a week.
If its systems fail on Friday, it could lose several days of work.
Having three copies won't help if all three are outdated.
Ask yourself:
If my computer stopped working right now, how much recent information could I afford to lose?
That answer should influence how often your backups run.
There's also a practical difference between restoring from a nearby external drive and downloading a large amount of information from a cloud service.
Internet connection speeds, the amount of data, service limitations, and the equipment available can all affect recovery time.
For a home user, a lengthy download might be an inconvenience.
For a business that depends on its systems to operate, it could mean significant downtime.
The right backup arrangement depends on both how much information you can afford to lose and how quickly you need it back.
The 3-2-1 rule gives you a structure. Your actual needs determine how you implement it.
Here's where things get interesting.
You can follow the 3-2-1 rule and still have a backup problem.
That's because the rule primarily addresses how many copies you keep, what storage you use, and where those copies are located.
It doesn't automatically guarantee that they're secure, current, or recoverable.
Let's look at several situations where additional protection matters.
Ransomware is malicious software that can encrypt files and make them inaccessible.
Attackers may also attempt to locate and destroy backups so that victims have fewer recovery options.
If all your backups are accessible through the compromised computer or the same stolen credentials, they may be at risk.
What helps?
Keep at least one backup disconnected when not in use or protected against unauthorized changes and deletion.
Some backup services offer protected recovery points that cannot easily be altered during a specified period.
The important question is whether the same attacker can reach and destroy every usable copy.
If you're recovering from ransomware, restoration should also happen on systems confirmed to be clean, using backups that haven't been compromised.
Otherwise, you risk restoring the original problem along with your information.
Imagine using the same account to manage your computer, cloud storage, and backup service.
If someone gains control of that account, they may gain access to multiple systems.
Depending on the permissions available, they might be able to delete or modify your backups.
What helps?
Use strong, unique passwords or passphrases, enable multi-factor authentication, and limit who can change or delete backup information.
For businesses, backup administration should have appropriate access controls rather than relying on unrestricted everyday accounts.
Suppose an important document becomes corrupted on Monday.
You don't notice the problem until Friday.
Your backup software has been running every night, faithfully copying the corrupted file.
If every backup simply replaces the previous version, you may no longer have a usable copy.
What helps?
Keep older recovery points.
That means preserving earlier versions of your information instead of keeping only the most recent copy.
How long should you keep them?
That depends on how long a problem might go unnoticed, the importance of the information, and any legal or business retention requirements.
For some information, keeping several weeks of recoverable versions may be appropriate. Other situations require considerably longer periods.
The important distinction is that three copies and three historical versions are not the same thing.
Multiple copies protect against losing storage.
Older versions help protect against changes or damage you discover later.
Your documents might be safely backed up, but what about the photographs on your phone?
Your email archives?
Your accounting database?
Your application settings?
Or important records stored in folders you rarely open?
People often assume that protecting one computer means they've protected everything they care about.
It doesn't.
What helps?
Make a list of the information and systems you depend on.
Then confirm that each is actually included in an appropriate backup.
This is particularly important for businesses because some applications require special backup procedures to preserve their data correctly.
Here's the one that brings us right back to our previous article.
You've got three copies.
They're on different storage systems.
One is offsite.
Everything looks wonderful.
But nobody has ever attempted a restoration.
Can you actually retrieve the files?
Do they open correctly?
Can you restore the business application that depends on them?
How long will it take?
What helps?
Test your recovery process.
Start by restoring a single non-sensitive file to a separate location.
Open it and verify its contents.
Then, where appropriate, test an older version, a larger folder, or an entire application.
For critical business systems, plan larger recovery tests carefully so they don't disrupt normal operations.
Three copies give you options. Testing tells you whether those options actually work.
You don't need an elaborate IT department to start improving your backup arrangements.
You do need to know what you're protecting, where your copies are stored, and whether you can retrieve them.
Here's a practical checklist.
Identify what matters. List the important files, photographs, records, applications, and systems you cannot afford to lose.
Count your copies. Confirm you have your original information plus two separate backup copies.
Check your storage. Use different storage media types and avoid arrangements where one failure can destroy everything.
Keep one copy offsite. Protect against fire, theft, flooding, and other problems affecting your primary location.
Protect a copy from cyberattacks. Use disconnected storage or appropriately secured backups protected against unauthorized modification and deletion.
Decide how often to back up. Match the schedule to how frequently your information changes.
Preserve older versions. Keep enough recovery history to address problems discovered days or weeks later.
Secure your backups. Use encryption where appropriate, strong credentials, MFA, and restricted access.
Keep recovery instructions safe. Know where your backups are, how to access them, and where required passwords or encryption keys are securely stored.
Test a restoration. Recover a file, open it, and verify that it works.
Consider recovery time. Understand how long it might take to get important systems functioning again.
Review your plan. New devices, applications, and changes in how you work can create new backup requirements.
You don't have to accomplish everything in one afternoon.
Start with the information that matters most and work from there.
If the person who manages your backups were unavailable tomorrow, could someone else recover your business?
Perhaps your previous IT provider set everything up.
Maybe one employee knows how the backup system works.
Or perhaps nobody has documented the recovery process.
A backup strategy shouldn't depend entirely on one person's memory.
Appropriate documentation, secure access to recovery information, and clear responsibilities can make an enormous difference when something goes wrong.
And remember, backups often contain the same sensitive information as the systems they protect.
They deserve proper security, too.
Let's return to our family photographs.
If the only copies are on your computer and an external drive sitting beside it, a single disaster could destroy years of memories.
Keeping another copy safely offsite makes that outcome less likely.
That's the value of the 3-2-1 rule.
Three copies give you alternatives.
Two types of storage reduce reliance on a single storage technology.
One offsite copy helps protect against losing everything in one location.
But remember what we've learned.
Three copies don't help much if they're all outdated.
An offsite backup isn't automatically protected against ransomware.
And none of those copies is especially useful if you can't actually restore the information when you need it.
The 3-2-1 rule is an excellent foundation, but it works best when combined with appropriate security, sensible backup schedules, older recovery points, and regular restoration testing.
You don't need to understand every detail of computer storage to put these principles into practice.
You simply need to ask the right questions.
What am I protecting? Where are my copies? What could destroy them? And have I proven I can get them back?
Because the goal isn't to collect backups.
It's to make sure the things that matter to you survive when something goes wrong.
Back up what matters. Keep your copies separate. And prove you can recover.
Further Reading: Canadian Centre for Cyber Security — Tips for Backing Up Your Information
Digital Drive IT Solutions
Demystifying technology so people can make better decisions.