Toolkit
← All posts

Backing up your digital life properly: the 3-2-1 rule in practice

Toolkit Blog · · Best practices · 8 min read

Three copies of your data, on two different kinds of media, with one of them off-site. It's the oldest advice in backup, it's still the right advice, and almost nobody actually has it — because most people count their cloud sync folder as a backup, and it isn't one. Here's what each number is really protecting you from, what it costs in 2026, and a setup you can build in an afternoon.

What the rule says, and where it came from

The 3-2-1 rule was popularised by the professional photographer Peter Krogh in his 2005 book The DAM Book: Digital Asset Management for Photographers[2]. Two decades later it is still the default recommendation from backup vendors and security agencies alike, and it fits on a napkin:

The reason it has survived is that it isn't a technology recommendation. It's a statement about independence: each number removes one category of correlated failure. Get the categories right and the specific hardware barely matters.

It is also not the same thing as "I have backups." A Western Digital survey of 6,118 people across ten countries, published in March 2025, found 87% of respondents said they back up their data in some form — and 63% said they had still lost data to device failure, accidental deletion or a cyberattack[13]. The gap between those two numbers is what the rest of this article is about.

Why three copies: the arithmetic of things breaking

Start with the drive itself. Backblaze publishes failure statistics for its entire production fleet every quarter, which makes it the best public dataset on how disks actually die. In Q1 2026 it monitored 341,263 drives and recorded a quarterly annualised failure rate of 1.24%, with a lifetime rate across the whole dataset of 1.39%[3]. Newer high-capacity drives do better — the 20TB-and-larger pool ran at a 0.85% annualised failure rate across more than 86,000 units[4].

Roughly one in a hundred per year sounds reassuring until you do the arithmetic on two copies. If your only backup is a single external disk, you need both drives alive at the moment you need the restore, and those odds compound over the years the disk sits in a drawer. Worse, home drives fail in correlated ways: the same power surge, the same drop off the desk, the same house fire. Three copies isn't superstition about probability — it's insurance against the fact that your failures are not independent.

And drive failure is the rare case. The far more common way people lose files is that they delete something, overwrite it, or let software corrupt it, and don't notice for weeks. That failure mode doesn't care how reliable your disk is — which brings us to the part most people get wrong.

Cloud sync is not a backup

If your plan is "everything's in Google Drive / Dropbox / iCloud," you have one copy with a convenient mirror, not two copies. Sync services are designed to make every device agree with the server. When you delete a file, that deletion is the change being synchronised. When ransomware encrypts a folder, those encrypted files are the change being synchronised.

Sync services do keep a safety net, but it's a short one, and it's worth knowing your actual number. Google Drive holds deleted items in the trash for 30 days: "After 30 days, your files are deleted forever"[6]. Dropbox's recovery window depends entirely on what you pay — 30 days on Basic, Plus and Family; 180 days on Professional, Standard, Essentials and team plans; 365 days on Advanced, Enterprise and Education[7] (as of September 2026). Delete a folder of photos and notice in February, and a 30-day window is not a backup.

This is the "two media types" clause doing real work. It's usually described as disk-and-cloud or disk-and-tape, but the underlying point is failure-mode diversity, not gadget diversity. A copy that automatically mirrors your changes shares a failure mode with the original; a copy that keeps versioned history does not. Two external drives in the same drawer are technically two copies but only one failure mode.

The off-site copy, and what it actually costs

The off-site copy covers everything that happens to the building: fire, flood, theft, or a burst pipe over the closet where the backup disk lives. Two shapes of it, depending on how much control you want:

Whichever you pick, encrypt before it leaves the house. Both of the tools below do client-side encryption by default, which means the storage provider holds ciphertext and a breach on their end isn't a breach of your photos. The corollary is that the passphrase becomes a single point of failure — write it down, store it somewhere physical, and treat losing it as equivalent to losing the backup.

The two numbers the rule leaves out

3-2-1 predates ransomware as a mass-market problem, and the industry has quietly extended it. Veeam's version is 3-2-1-1-0: the extra 1 is one copy that is offline, air-gapped or immutable, and the 0 is zero recovery errors — backups verified by actually restoring them, not by trusting a green checkmark[1].

Both additions are responses to measured behaviour. Sophos's seventh annual State of Ransomware report — a vendor-agnostic survey of 2,158 IT and security leaders across 17 countries whose organisations were hit in the previous 12 months — found backup-based recovery rose to 66% of encrypted-data cases in 2026, up 12 percentage points year on year[5]. Backups are what gets people out, which is precisely why attackers go looking for them first, and why a copy your logged-in machine can reach and overwrite is a copy that can be taken from you.

For a household, "offline" needs nothing exotic. A second external drive that lives unplugged in a drawer, or at a relative's house, and gets connected once a month is air-gapped in every way that matters: no malware running on your laptop can touch it on a Tuesday afternoon.

The zero is the one people skip, and the one that actually bites. An untested backup is a hypothesis. Once a quarter, restore something — a folder, a few photos, one important document — to a scratch location and open it. Pick a real file, not a test file you made for the purpose.

Verifying a restore: the honest way to check a restored file is bit-identical to the original is to compare checksums, not eyeball it. Toolkit's file checksum tool hashes a file entirely in your browser — nothing uploads — so you can hash the original and the restored copy and confirm the digests match. If checksums are new to you, how to verify a download with a checksum covers the same idea in more detail.

A 3-2-1 setup you can build this weekend

Concretely, for one household, in rough order of effort:

  1. Copy 1 — the live data on your laptop or desktop. Nothing to do here.
  2. Copy 2 — a local, versioned backup. On a Mac, Time Machine is genuinely good and already installed: Apple says it keeps hourly backups for the past 24 hours, daily backups for the past month and weekly backups for all previous months, and recommends a drive with at least twice your Mac's capacity[8]. On Windows or Linux the equivalent is a scheduled job with one of the tools below. This is the copy that saves you from yourself — the accidental delete, the bad edit — because it has history.
  3. Copy 3 — off-site. Either the $99/year managed service or your own encrypted repository in object storage.
  4. The extra 1 — offline. A cheap external drive, plugged in monthly, otherwise unplugged and ideally not in the same building.
  5. The 0 — verification. A calendar reminder every three months to do one real restore.

If you want to run copies 3 and 4 yourself, two mature open-source tools dominate and either is a safe bet:

Deduplication is why this stays affordable: months of history without paying for months of duplicate photos. Pick one, point it at the same source folders as your local backup, and let the schedule do the rest.

Where the rule doesn't fit

Three honest limits, because "back up everything three times" is bad advice taken literally.

Not everything deserves three copies. Re-downloadable media, game installs and caches are replaceable; keep the discipline for what's genuinely irreplaceable — photos, documents, code, correspondence, financial records. A smaller backup set is one that actually completes, and the usual cause of an abandoned backup routine is trying to protect a terabyte of stuff you don't care about.

If you'll never do the maintenance, buy the managed option. A self-hosted repository you stop feeding is worse than a $99/year service you forget about, because it hands you false confidence. If you already run a home server, adding backup targets is easy — our self-hosting primer covers that ground — but don't start a homelab in order to have backups.

The passphrase is part of the system now. Client-side encryption means nobody can read your data, including you, if you lose the key. Any plan that depends on a passphrase needs a recovery plan for the passphrase: on paper, in a safe, or with someone you trust. More people lose encrypted backups to forgotten passwords than to attackers.

None of this is hard — one afternoon of setup and one restore test a quarter, against the category of loss that has no undo. The 3-2-1 rule has lasted twenty years because the failure modes it names haven't changed. Only the price of covering them has.

Sources

  1. Veeam — 3-2-1 backup rule explained (and the 3-2-1-1-0 extension), updated July 3, 2026, accessed September 2026
  2. Barracuda Networks — What is the 3-2-1 backup rule? (origin: Peter Krogh, The DAM Book, 2005), accessed September 2026
  3. Backblaze — Drive Stats for Q1 2026, published July 9, 2026, accessed September 2026
  4. Backblaze Investor Relations — Backblaze publishes Q1 2026 Drive Stats (press release), July 9, 2026, accessed September 2026
  5. Sophos — The State of Ransomware 2026, accessed September 2026
  6. Google Drive Help — Learn what happens when you delete a file in Google Drive, accessed September 2026
  7. Dropbox Help — How long does Dropbox keep my deleted files and information?, accessed September 2026
  8. Apple Support — Back up your Mac with Time Machine, accessed September 2026
  9. BorgBackup — official project site, accessed September 2026
  10. restic — official repository (README), accessed September 2026
  11. Backblaze — Computer Backup pricing, accessed September 2026
  12. Backblaze — B2 Cloud Storage pricing, accessed September 2026
  13. TechSpot — Western Digital survey of 6,118 people across 10 countries on backup habits, March 26, 2025, accessed September 2026

Related: Self-hosting 101: what's worth running on your own hardware in 2026 · How to verify a download with a checksum · How to share passwords safely