Every storage device eventually fails, gets lost, or is stolen. A phone falls in water, a laptop drive stops responding, a cloud account gets locked, or ransomware (malicious software that encrypts your files and demands payment) scrambles everything it can reach. People who have a backup shrug and restore. People who do not lose years of photos and documents.
This guide is for anyone with a phone, a computer and files they would hate to lose. It explains the 3-2-1 rule, compares cloud storage with external drives, and walks through a setup you can finish in an afternoon. At the end you will test a restore, which is the step most people skip and the one that proves the plan works.
What the 3-2-1 rule means
The 3-2-1 rule is a long-standing guideline that the US cybersecurity agency CISA also recommends. It lists three parts: three copies of important files, two different types of storage media (for example a hard drive and the cloud), and one copy stored off-site, away from your home or business.
The "three copies" include your original. So your photos on your phone count as copy one. A copy on an external drive is copy two, and a copy in a cloud service is copy three. That setup also satisfies the other two parts, because the drive and the cloud are different media, and the cloud is off-site by nature.
Each part guards against a different risk. Multiple copies protect against a single device failing. Different media protect against a flaw that affects one kind of storage. An off-site copy protects against fire, flood and theft, which can destroy everything in one building.
Backup versus sync
Many people believe their files are safe because they use a service that keeps them on several devices. That is syncing, and it works differently from backup. If you delete a folder by accident on your laptop, a sync service deletes it everywhere. If ransomware encrypts files on your computer, the encrypted versions can sync to the cloud.
A real backup keeps older versions and deleted items for a period of time. Check that the cloud service you use offers version history or a recycle bin and how long it keeps items. The UK National Cyber Security Centre advises confirming that your provider lets you restore earlier versions of modified data and recover deleted data within a set time window.
Cloud storage versus external drives
You do not have to choose one. The best plan uses both, because their weaknesses differ.
| Factor | Cloud backup | External drive |
|---|---|---|
| Protects against fire or theft at home | Yes | Only if stored elsewhere |
| Works automatically in the background | Yes, once set up | Only when connected, unless you schedule it |
| Ongoing cost | Subscription, often based on storage size | One-time purchase |
| Speed of restoring large amounts of data | Limited by internet speed | Fast |
| Works without internet | No | Yes |
| Risk | Account lockout, provider changes, price rises | Drive failure, loss, physical damage |
Cloud services are convenient but depend on an account. Protect it with a strong, unique password and multi-factor authentication (a second check, like a code from an app). If a provider's prices rise or you want to leave, you need a copy elsewhere, which is one more reason to keep a local drive. If you are watching recurring costs, see our guide to a household subscription audit.
Set up your plan step by step
- List what matters. Photos and videos, documents, tax and identity records, and anything you cannot download again. Ignore apps and system files, since you can reinstall them.
- Estimate the total size. Check the storage used by your photo library and document folders. This decides how big a drive and which cloud tier you need. Choose a drive with room to grow, since photo libraries rarely shrink.
- Gather your files into a few clear folders. One tidy folder structure makes backups simpler to schedule and check.
- Turn on automatic phone photo backup. Use the cloud photo option built into your phone or an app you trust, and set it to upload on Wi-Fi to avoid using mobile data. Check the settings screen to confirm the last upload time.
- Set up a computer backup to an external drive. Both Windows and macOS include built-in backup tools. Connect the drive, choose the folders, and set a schedule, such as weekly.
- Add an off-site copy. Use a cloud backup service for your computer's important folders, or keep a second drive at a relative's home or workplace and swap it every few months.
- Protect the backups. Encrypt the external drive if your system offers it, and use strong credentials on cloud accounts. Store the drive somewhere safe.
- Write down the plan. A short note listing where each copy lives and how to restore it helps if someone else ever needs to find your files.
Keep one copy out of reach
Backups that stay plugged in or logged in all the time can be damaged by the same event as the original. The NCSC has seen ransomware encrypt not only live data but also connected USB and network drives holding backups. Its advice is to keep at least one backup offline, connecting it only when needed.
For a home setup, that can be as simple as an external drive you plug in once a week for the backup to run and then disconnect. Cloud storage cannot be unplugged, so protect the account with multi-factor authentication and, where the service allows, sign out of backup tools you are not using.
Test a restore
CISA recommends testing your backup procedure to make sure you can restore data both fully and partially, and running scheduled recovery tests to check that the backups are intact. You can do a home version in 15 minutes.
- Pick five files at random. Include a photo, a document and one older file.
- Restore them to a different location. Do not overwrite the originals.
- Open each file. Check that it opens, that the photo shows correctly and that the document is complete.
- Check dates. Confirm that your most recent photos and files are in the backup.
- Fix what failed. If anything is missing, find out why before you rely on the plan.
Repeat this twice a year, and also after you change phones, computers or cloud services.
Common mistakes
- Treating sync as backup. Deletions and ransomware spread across synced devices.
- Keeping all copies in one place. A drive stored next to the laptop will not survive a fire or burglary.
- Never checking the backup. Backups can fail quietly because of a full drive, a changed password or an expired subscription.
- Using a single old drive for years. Drives wear out, so replace them on a schedule instead of waiting for a failure.
- Forgetting the phone. Many people back up their computer and leave years of family photos on a device that is easy to lose.
- Weak account security. A cloud backup is only as safe as the password and second check protecting it.
Frequently asked questions
How often should I back up?
Automatic photo backup should run continuously. For documents, daily or weekly is fine for most people. A good rule is to back up as often as the amount of work you would be willing to redo.
Is one cloud service plus my phone enough?
Not by the 3-2-1 definition, because that gives you two copies on one type of storage. Add an external drive or a second service to reach three copies on two media types.
What should I do with old drives and photos I no longer need?
Keep the backup until you have confirmed a restore from the new one. When you dispose of a drive, erase it using your system's secure erase option or physically destroy it, since deleted files can often be recovered.
How do I back up photos from a phone I am about to replace?
Run a final backup, restore a few photos to confirm they are intact, and then set up the new phone with the same backup service. Our guide to choosing a smartphone covers how storage needs affect the model you buy.
Next steps
- Turn on automatic photo backup on your phone today and check that a recent photo appears in the cloud.
- Buy or find an external drive larger than your files and schedule a weekly computer backup.
- Add an off-site copy through a cloud service or a drive kept elsewhere, and secure the account with multi-factor authentication.
- Put a reminder in your calendar for a restore test in six months.
