Everyone agrees backups matter and almost nobody has one that actually works. This guide covers how to back up your data properly — the 3-2-1 rule and why it exists, the difference between sync and backup (which trips up nearly everyone), automating it on every platform, and the single step that separates a real backup from a comforting illusion: testing that you can actually restore. It is the data-protection guide of Mahi Info Tech.
Sync Is Not Backup
Start here, because this misunderstanding destroys more data than hardware failure does.
A sync service mirrors your files across devices. Change a file on your laptop and the change appears everywhere. That is convenient — and it is precisely why it is not a backup. If you delete a file, the deletion syncs. If ransomware encrypts your folder, the encrypted versions sync. If you overwrite a document with garbage, the garbage syncs. Sync faithfully propagates your mistakes at the speed of light.
A backup keeps historical copies that a change on your device cannot reach out and destroy. It has versioning, so you can go back to how a file looked last Tuesday. It is, crucially, separate from your working data rather than a mirror of it.
Most cloud storage services do include some version history and a recycle bin, which softens the distinction — but the retention window is often short, and it will not save you from a problem you do not notice for a month. Treat sync as convenience and set up a real backup separately.
The 3-2-1 Rule
This is the industry standard, and it survives because it works.
- 3 copies of your data — the working copy plus two backups.
- 2 different types of storage — for example an external drive and cloud storage, so one failure mode cannot take out both.
- 1 copy off-site — somewhere physically elsewhere, so fire, flood or theft at your home does not destroy everything at once.
For a normal person this translates to something quite simple: your files live on your computer, an automatic cloud backup runs continuously, and an external drive holds a periodic full copy. That is 3-2-1 without any complexity, and it is genuinely achievable in an afternoon.
The off-site copy is the one people skip, and it is the one that matters in exactly the scenarios where you need a backup most. An external drive sitting next to your laptop protects you against a failed disk. It protects you against nothing that happens to the room.
What to Actually Back Up
You do not need an image of your entire system, and trying to back up everything is a common reason people give up. Prioritise ruthlessly:
| Priority | What | Why |
|---|---|---|
| Critical | Photos, videos, documents, creative work | Irreplaceable — cannot be re-downloaded |
| Critical | Password manager vault, 2FA recovery codes | Losing these locks you out of everything |
| High | Financial records, contracts, ID scans | Painful and slow to reconstruct |
| Medium | Email archive, contacts, calendars | Often already in the cloud, but verify |
| Low | Applications, operating system | Reinstallable — do not waste effort here |
The rule of thumb: back up what you created, not what you downloaded. Your holiday photos are irreplaceable. Your operating system is a download away.
That second row deserves emphasis. People diligently back up their photos and completely forget their two-factor recovery codes. Lose those and you can be permanently locked out of accounts even though you did everything else right. Print them, or store them in a way that does not depend on the device you are trying to recover.
Setting It Up on Windows
Windows has a built-in tool called File History. Plug in an external drive, enable it, and it will automatically keep versioned copies of your libraries — including previous versions of files, which is exactly what distinguishes a backup from a sync.
For a complete disaster-recovery copy, create a full system image so you can restore the entire machine rather than reinstalling everything by hand. Combine that with a cloud backup service running continuously, and you have the local and off-site copies the 3-2-1 rule requires.
Setting It Up on Mac
Time Machine is genuinely excellent and it is right there. Connect an external drive, switch it on, and it keeps hourly, daily and weekly snapshots automatically, letting you step back to any previous state of any file. Pair it with a cloud backup for the off-site copy and you are done. There is very little excuse for a Mac user not to have a working backup.
Setting It Up on Android and iPhone
Both platforms offer automatic cloud backup of settings, app data, contacts and messages. Turn it on — but verify what it actually includes, because the defaults are often narrower than people assume, and free storage tiers are frequently too small to hold your photo library, which means the backup silently stops working.
That silent failure is the real danger. A phone that stopped backing up eight months ago because the storage filled up looks exactly like a phone that is backing up fine. Check the date of your last successful backup right now; it is a two-minute task that regularly produces an unpleasant surprise.
For photos specifically, use a dedicated photo backup service and confirm that it is uploading full-resolution originals rather than compressed copies. And keep a separate local copy of your photo library on a computer or drive, because a single cloud account is a single point of failure — if that account is lost or locked, so is everything in it.
Cloud Backup vs External Drive
| Cloud backup | External drive | |
|---|---|---|
| Off-site by default | Yes | No |
| Automatic | Yes, continuously | Only when connected |
| Restore speed | Slow for large amounts | Fast |
| Ongoing cost | Subscription | One-off purchase |
| Ransomware resistance | Good, with versioning | Only if disconnected |
| Depends on a company | Yes | No |
The right answer is both, which is exactly what 3-2-1 is telling you. They fail in different ways, and that is the point.
One critical detail on the external drive: disconnect it when the backup finishes. A drive left permanently plugged in is just another folder on your computer, and ransomware will encrypt it along with everything else. A disconnected drive is immune to anything happening on the machine.
Ransomware and Why Versioning Matters
Ransomware encrypts your files and demands payment. It is the scenario where backups stop being good practice and become the only thing standing between you and total loss. But it also defeats naive backups, which is why the details matter.
If your backup simply mirrors your current files, the encrypted versions overwrite the good ones and your backup is worthless. You need versioning — the ability to restore files as they existed before the attack. And you need at least one copy the malware cannot reach, which means either a disconnected drive or a cloud service with immutable version history. Our cybersecurity guide covers the prevention side; this is the survival side.
The Step Everyone Skips: Test the Restore
A backup you have never restored from is not a backup. It is a belief.
Backups fail silently and constantly. The drive fills up. The service disconnects after a password change. The scheduled job stops running after an update. The folder you thought was included never was. None of these announce themselves — you find out at exactly the moment you cannot afford to.
So test it. Once a quarter, pick a file at random, delete it (or pretend to), and restore it from your backup. Confirm the file opens and the contents are correct. Check the date of your most recent successful backup while you are there. This takes ten minutes and it is the difference between a real safety net and a comforting story you tell yourself.
Backing Up What People Always Forget
Most people, when they finally set up a backup, cover their documents and photos and consider the job done. Then, when disaster strikes, they discover a list of things they never thought about — and some of them are the hardest to reconstruct.
Your two-factor recovery codes top that list. If your phone is lost or wiped and you have no recovery codes, you can be permanently locked out of accounts even though every other part of your backup worked perfectly. Print them, or store them somewhere that does not depend on the device you are recovering.
Beyond that: your password manager’s vault and its emergency access arrangements. Browser bookmarks, which quietly represent years of accumulated knowledge. Software licence keys. Your contacts, if they live only on one device. Messaging app histories, which are not always included in a phone’s default backup and which people are frequently devastated to lose. And configuration you have built up over years — email rules, application settings, the dotfiles a developer has spent a decade refining.
Backups for Small Businesses and Freelancers
If work depends on your data, the calculation changes entirely, because the cost of loss is no longer sentimental — it is measurable, and it compounds. Two additional principles apply.
First, define your recovery time honestly. How long can you actually be unable to work before it becomes a serious problem? If the answer is a few hours, restoring hundreds of gigabytes from a cloud service over a domestic connection will not meet that, no matter how diligently it has been backing up. You need a local copy you can restore from quickly, with the cloud copy as the disaster fallback.
Second, keep at least one backup that is genuinely offline and unreachable from your working machine. Ransomware specifically seeks out connected backups, and an external drive left permanently plugged in is simply another folder to encrypt. A drive that is disconnected and sitting in a drawer is immune to anything happening on your computer. Rotate two drives if you can, keeping one off-site, and test a restore properly every quarter — not just checking that files exist, but actually opening them and confirming the contents are intact.
Quick Reference: Backup Do’s and Don’ts
- Do follow 3-2-1 — three copies, two media types, one off-site. It exists because each part covers a different disaster.
- Don’t confuse sync with backup — sync replicates your mistakes instantly; backup keeps versions that survive them.
- Do disconnect the external drive when finished — a permanently attached drive gets encrypted along with everything else.
- Don’t forget your 2FA recovery codes and password vault — losing these locks you out of everything you saved.
- Do test a restore quarterly — an untested backup fails silently and you find out at the worst possible moment.
Frequently Asked Questions
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of storage, with one stored off-site. This protects you against drive failure, accidental deletion, and physical disasters such as fire or theft, each of which would defeat a simpler approach.
Is cloud storage the same as a backup?
No. Sync services like cloud drives mirror changes, so a deletion or a ransomware encryption propagates to every copy. A true backup keeps versioned historical copies that changes on your device cannot destroy. Use both, and understand which is which.
How often should I back up?
Continuously for anything important — set it and forget it. Ask yourself how much work you could stand to lose. If the answer is “a day,” back up daily. Automation matters more than frequency, because a manual backup is one you eventually stop doing.
Do I need to back up my whole computer?
No. Back up what you created — photos, documents, creative work, financial records, your password vault and 2FA recovery codes. Applications and the operating system can be reinstalled, so spending effort on them is usually wasted.
Will a backup protect me from ransomware?
Only if it has versioning and at least one copy the malware cannot reach. A mirrored backup will simply receive the encrypted files. A disconnected external drive, or a cloud service with immutable version history, is what actually saves you.
Final Thoughts
Backups are boring right up to the moment they are the most important thing you own. The good news is that a solid setup is genuinely a one-afternoon job: turn on your platform’s built-in backup to an external drive, add a continuous cloud backup for the off-site copy, make sure your photos and your recovery codes are covered, and then disconnect the drive when it finishes. After that, the only ongoing obligation is a ten-minute restore test every few months — the one step that converts a hopeful assumption into an actual safety net.
Explore more practical guides, security explainers and technology tutorials across Mahi Info Tech, and see our guide on how to recover deleted files if you are already in trouble.