“Everything is in the cloud” is the usual answer to a question about backups. The trouble is that a cloud is normally not a backup but a sync: delete a file on the laptop and it disappears there too. Ransomware encrypts it and both copies are encrypted.
The 3-2-1 rule
Simple and old, and still working.
-
Three copies of the data
The original and two copies. One copy is one point of failure: until it has been tested you do not know whether it works.
-
Two different media
Not two partitions of one disk. An external drive and a cloud, a drive and network storage — what matters is that one device failing does not take both copies.
-
One copy off-site
A cloud, or a drive at a relative's place. Fire, flooding and theft take everything in one flat, regardless of how many disks there are.
What to back up first
| Data | Recoverable? | Priority |
|---|---|---|
| Photos and video | Never | First — the thing people miss most |
| Documents and contracts | Partly, via whoever issued them | First |
| The password vault | No, if it is local | First |
| Second-factor backup codes | No | First |
| Messages and notes | Sometimes via the service | Second |
| Programs and the system | Yes, by reinstalling | Third |
How to know the backup works
An untested copy is a hope, not a copy. Testing takes five minutes and happens twice a year.
- Cloud sync without version history
- A second partition of the same disk
- A drive that is always connected
- A copy nobody has ever opened
- A cloud with version history and a bin
- A separate drive connected on a schedule
- A copy at a relative's or elsewhere
- Verified by opening files