The 3-2-1 Backup Rule, and the Photos You Can’t Get Back
A few years back, someone I know handed me a laptop that wouldn’t turn on. Not a big deal, I figured — we’ll pull the files off the drive and move them to a new machine. Then the drive made the sound. If you’ve heard it, you know the one: a soft, rhythmic click that means the hardware is gone and it’s not coming back.
On that drive were eleven years of family photos. No other copy. Not on a phone, not in the cloud, not anywhere. Every birthday, every trip, every ordinary Tuesday — gone in the time it takes a bearing to seize. There was nothing I could do but say so, which is the worst part of my job.
That’s what a missing backup actually looks like. Not a headline, not a hacker — just a quiet mechanical failure and a person realizing, too late, that “it’s all on the computer” was never a plan.
The good news: avoiding that outcome is genuinely simple, and it has a name.
Quick summary: The 3-2-1 backup rule says keep three copies of anything you’d hate to lose, on two different kinds of storage, with one copy somewhere else entirely. Your files on your computer plus an external drive plus a cloud backup does it. The one trap to avoid: syncing (iCloud, Dropbox, OneDrive) is not the same as backing up.
What the 3-2-1 backup rule actually means
It’s three numbers, and each one closes a different way of losing your stuff. CISA, the U.S. government’s cybersecurity agency, recommends it in plain terms:
Three copies of any file that matters. The original counts as one, so you need two more.
Two different types of storage. Say, your computer’s drive and an external hard drive — so a single failure or a single format going bad can’t take everything at once.
One copy off-site. Somewhere physically separate from the others, which for most of us means the cloud. This is the copy that survives a house fire, a flood, or a burglar who takes the laptop and the backup drive sitting next to it.
A copy that lives right beside the original isn’t really a backup. It’s a second victim of the same accident.
What that looks like for a normal person
You don’t need server racks or a computer-science degree. Here’s the everyday version.
Copy one is the file where it already lives — on your laptop or phone. Free, and you already have it.
Copy two is an external hard drive. A drive that holds more than most people will ever fill costs less than a nice dinner out these days, and both Windows and Mac have backup built in — Windows File History and Mac’s Time Machine will copy to it automatically once you plug it in and flip one setting.
Copy three is a cloud backup — an online service that quietly uploads a copy of your files in the background, so there’s always a version living somewhere other than your house. Several run a few dollars a month, and the good ones you set up once and then forget.
Set up the drive and the cloud service, and you’ve gone from zero real backups to satisfying the whole rule in an afternoon.
The trap: syncing is not backing up
This is the correction I’d point to more than any other, because it’s the one that fools careful people.
iCloud, Dropbox, OneDrive, and Google Drive are sync services. They keep the same folder identical across your devices — which is convenient, and which is not a backup. The catch is in the word “identical.” If a file gets deleted, corrupted, or scrambled by ransomware on one device, sync faithfully copies that damage everywhere within minutes. Your safety net just got shredded in sync with the original.
A real backup keeps history — older versions you can roll back to, copies the live system can’t reach out and ruin. That’s the difference between “the same file, in more places” and “a copy from before things went wrong.” You can absolutely use sync for convenience. Just don’t mistake it for your third copy.
What I’d do: An external drive with automatic backup turned on, plus one cloud backup service running quietly in the background. Set both once, check on them a couple of times a year.
What I’d skip: Relying on a sync folder as my only “backup,” and burning a weekend building something elaborate. The boring two-part setup above beats a clever plan you’ll never finish.
One more habit the pros never skip: test it. A backup you’ve never restored from is a hope, not a guarantee. Once it’s set up, try pulling back a single file you don’t need — just to prove the door opens before the day you’re desperate to walk through it.
The insurance you’re glad is boring
Backups are the most boring thing on your to-do list right up until they’re the only thing that matters. Nobody has ever regretted having one. Plenty of people have stood where my friend stood, holding a dead drive and a decade of memories that existed in exactly one place.
Spend the afternoon. Future you — the one who spills coffee on the laptop, or clicks the wrong link, or just wakes up to a drive that won’t spin — will be so relieved you did.
Verified resources & documentation
- CISA — Back Up Your Data (the 3-2-1 approach)
- CISA / US-CERT — Data Backup Options (PDF)
- CISA — StopRansomware.gov
- Ready.gov — Safeguard Critical Documents and Valuables
Keep reading
- What Happens to Your Data When a Company Gets Hacked
- Password Managers Explained: What They Are and Why You Actually Need One
- Public WiFi and the Apple Ecosystem: What Hotel Networks Can and Cannot See
This is general information, not personal security advice. Your situation may differ — verify with a professional for high-stakes decisions.