The 3-2-1 backup rule: add a copy ransomware cannot touch

You think you have a backup. Then the laptop dies, or ransomware hits, and the only other copy was sitting on a drive still plugged into the same machine. That sick feeling is common. The 3-2-1 backup rule is the fix: three copies, two kinds of storage, one copy somewhere else. The update that matters now is a fourth idea. At least one copy needs to be offline or immutable, so ransomware cannot encrypt it too.

• Count your copies. The live files plus two backups. One extra USB on the desk is not enough.
• Split the media. Do not keep both backups on the same type of drive, on the same shelf.
• Put one copy off-site. Cloud, or a drive that lives somewhere else. A house fire should not take everything.
• Unplug one copy, or lock it. An "offline" drive that stays in the USB port is still connected.

If files have already gone missing, stop guessing and treat it as recovery. Data Recovery Scientist covers homes and offices across NSW. Sydney can start with data recovery across Sydney. Central Coast homes can use data recovery on the Central Coast.

What the 3-2-1 backup rule actually means

The rule is three short parts. Once you map them to your own files, it stops feeling technical.

Three copies means the original plus two backups. Not one spare drive. Two. Two different media means you do not park both backups on the same kind of storage. A laptop and a Time Machine disk left beside it are still one pile if the house goes. One off-site means at least one copy lives somewhere physically separate: another building, or a cloud account that is not just a sync folder on the same desk.

A home setup might look like this. Photos live on the laptop. A second copy sits on an external drive. A third copy goes to a cloud backup. A freelancer might keep working files locally, a drive at the office, and an encrypted cloud job overnight. A small business often uses a server or main PC, a NAS for fast local restores, and a cloud backup nobody uses for day-to-day logins.

The detail people miss: the copies have to be independent, with versions. If a folder syncs every change instantly, it copies a deleted file and ransomware just as fast as a real save. That is a mirror. Victorian Government backup guidance treats a mirror as the thing that breaks together, not a backup.

Media, versioning, and where people go wrong

Local disks and a NAS restore quickly. They are also easy for ransomware to find if they stay on the same network. A removable drive you can unplug adds a real gap. Cloud storage adds distance. Some cloud plans can lock a backup so even an admin cannot delete it early.

A mix that works for a lot of NSW homes and small offices: working files, a NAS or external drive for the fast restore, and a cloud job as the off-site leg. That covers three copies and two media types. Nobody has to carry a drive across town every Friday, unless you want that extra offline copy as well.

Versioning is what makes it a backup. If a file is encrypted on Monday, you need Sunday's version. A job that overwrites the same backup file every night leaves you with one point in time. If something has been wrong for a week, last night's "success" is just a clean copy of the damage.

RAID gets mixed up with backup all the time. RAID protects against a dead disk, not a deleted file, ransomware, or a stolen PC. Delete a folder, and RAID copies that mistake across the array. Treat RAID as uptime, not recovery. If a NAS has already failed, stop and photograph the drive order first. Our NAS data recovery notes cover that stop-and-photograph habit.

The extra copy: immutable, offline, air-gapped

Attackers now hunt for mapped backup drives before they encrypt the rest. If they can wipe the restore option, payment looks more likely. That is why the extra "1" showed up.

3-2-1-1 adds one immutable or air-gapped copy. Some plans go to 3-2-1-1-0, where the zero means your restore tests came back clean. The ACSC backup advice asks for offline or immutable copies for the same reason: they still stand if someone gets into the network.

In practice that looks like a removable drive you back up to, then unplug and store somewhere else. Rotate two or three drives so you are never more than a day or two behind. Or it is tape, still used for this exact gap. Or it is a cloud bucket with object lock, where files cannot be changed or deleted for a set time, no matter who has the password.

Treat 3-2-1 as the floor. Then add one copy that cannot be edited on the day everything else is on fire.

Pro Tip: Set a recurring reminder to unplug the offline drive after each backup. A drive that lives in the USB port is just another connected disk with a nicer label.

Set it up in one afternoon

You do not need a project plan. You need an order.

1. Decide how long you can be down, and how much you can lose. That is recovery time and recovery point, in plain words. A home album might survive a day. An invoicing PC might not survive an hour.
2. Pick media that matches the scale. A household can use one external drive plus one cloud service. A small business usually wants a NAS for the fast restore, plus a cloud account for the disaster.
3. Automate it. Manual backups fail when someone is busy. Scheduled jobs with versioning on remove that guess.
4. Encrypt the backups, and keep the backup login separate. Turn on multi-factor authentication. If your everyday account is phished, the backup account should not fall with it.
5. Build the off-site and offline leg. Rotate a drive, or turn on immutability in the cloud, so one copy sits out of reach.
6. Restore something this week. Not next month.

After that, the habit is light. Glance at backup logs weekly. Rotate the offline drive on the day you already set. Review the whole setup once a year, or when the amount of data jumps.

Pro Tip: Give the backup account a name nobody uses for email. If the main login is phished, the attacker should not inherit the restore as well.

Microsoft 365 and other cloud apps

This is the misconception that costs businesses real mail and files. Microsoft keeping 365 online is not a backup of your content. The service can stay up while a mailbox is emptied, a SharePoint library is hit by ransomware from a synced PC, or files sit past the recycle bin window.

Your live tenant is copy one. A dedicated third-party backup of that tenant is copy two. An immutable or separate archive of that backup is copy three. Everything can still "live in the cloud" and still follow 3-2-1, as long as the copies are independent.

Whoever can delete those backups should use multi-factor authentication, and that login should not be the same as day-to-day email. Newcastle and the Hunter can start from data recovery in Newcastle if you would rather have a person check the tenant than guess from the admin centre alone.

Prove a restore works

A backup nobody has restored is a theory. Testing is the step most people skip. It is also the one that matters.

Write down two numbers in ordinary language. How long can you wait. How much work can you lose. A home user might wait a weekend for photos, and accept a week of gaps. A shop running point-of-sale might need two hours back online, and only fifteen minutes of lost sales. That second shop cannot back up once a night and call it done.

Rotate three kinds of test. One file is the request you will actually get: last week's invoice, the school assignment. One app checks that accounting or a database comes back working, not just present. A full rebuild is the only way to know your "two hours" is real.

Time it. Write down what happened. If the plan said two hours and the restore took six, that gap is the most useful thing you will learn all year. Better on a quiet Tuesday than during an outage.

Mistakes ransomware loves

Most backup failures are the same few habits. Ransomware is built to use them.

• Calling a sync folder a backup, then watching encrypted files copy everywhere.
• Leaving the backup drive plugged in, where the same attack can reach it.
• Skipping versions, so there is no clean Monday to roll back to.
• Never testing a restore, so the first failure is the emergency.

The fixes are direct. Lock a copy so it cannot be changed for a set time. Limit who can delete backups to one or two people. Put multi-factor authentication on those accounts. Encrypt the backup itself, so a stolen drive is not an open folder. Deletion rights should never sit with the whole team.

Setups you can copy this week

Pick the closest template and start. Waiting for a perfect stack is how backups never happen.

• Home: laptop as the working copy, external drive at home, cloud account off-site. Automate both. Unplug the drive between jobs if you can.
• Freelancer: local files, a NAS or office drive, plus an encrypted cloud backup on a separate login with multi-factor authentication.
• Small business: the production PC or server, a NAS for fast local restores, and a cloud backup with immutability on.

Whatever you pick, tick these: automate the jobs, encrypt in transit and at rest, keep one copy genuinely offline or immutable, restore a file now, write down how long you can wait, and review it once a year.

When to stop and call

Some moments are not a Saturday project. The risk of making it worse is the point, not your skill.

• The drive is clicking, grinding, or the NAS will not mount. Power down. Photograph the drive order. Do not keep powering it on to "just check."
• Ransomware already hit, and the backup share is encrypted too. Disconnect from the network. Do not wipe disks until someone has looked.
• Microsoft 365 mail or SharePoint vanished past the recycle bin. Stop making more changes. Tenant recovery is a different job to a local file copy.
• You have never restored, and the files you cannot replace are on one disk. That is a fair reason to get a person involved before you experiment.

Bring what you already have: which copies exist, where they live, and whether a restore has ever worked. That handful of detail lets a remote session tell you if the setup would save you, or if recovery has to come first.

What we see on visits

A lot of "we had a backup" stories are the same story. The job went green every night. Nobody had restored a file since the box was first set up. The USB drive was still plugged in. Or the NAS was RAID, and someone thought that counted. The jobs that go well are the ones where we design the extra offline copy first, then prove a restore before anyone trusts it.

We start with what you cannot lose, how long you can wait, then the media you already own. Tools get added when the numbers need them, not because a forum thread listed a brand. Work is approved before it starts.

PC Scientist can help with backups and recovery

Some of this is an afternoon. Some of it is a NAS that should not be powered on again, or a 365 tenant that needs a real backup rather than the recycle bin. That is a fair reason to stop. Data Recovery Scientist can look with you, remotely first if that is enough, or onsite if the hardware itself is the problem.

Tell us whether you are setting 3-2-1 up, or already missing files. Mention what copies you have, and whether a restore has ever worked. We will say whether a remote session will do, or whether a visit makes more sense. Call 0493 563 381, or pick your area below.

Sources

These pages help when you want the official wording:

• How to back up your files and devices - ACSC
• Backup data and devices - Victorian Government