The 3-2-1 backup rule

The drive arrived in a shoebox with a note that said "photos of the children, please help". It had been the family's only copy. It had been failing for months — the SMART data showed that clearly, and nobody had ever looked, because nothing tells you to look.

I recovered most of it. Most is not all, and the conversation about which part was missing is one I would rather not have again. Everything in this article exists because of conversations like that one, and the frustrating thing is that the rule preventing it is old, well known, and takes an afternoon to implement.

Three, two, one

Three copies of anything you cannot recreate. On two different kinds of storage. One of them somewhere else physically. That is the whole rule and each number is answering a specific way of losing things.

Three copies because drives fail independently and randomly. Two copies means you are one failure away from having one copy, and one copy is what the shoebox contained. The original plus two is not paranoia; it is the smallest number where a single failure is an inconvenience rather than an event.

Two kinds of storage because identical devices fail in correlated ways. Two drives from the same batch, bought together, running in the same machine at the same temperature, are not two independent chances. I have seen a matched pair fail within a fortnight of each other, which is exactly the scenario this number exists to prevent.

One copy elsewhere because fire, water and theft do not care how many drives are in the cupboard. This is the number people skip, because it is the inconvenient one, and it is the number that turns a bad day into a survivable one.

What RAID is not

Worth its own heading because the misunderstanding is close to universal and I have had to explain it to people who were, quite reasonably, convinced they were protected.

Two drives in a NAS mirroring each other means that if one dies, the machine carries on and you replace the failed one. That is availability. It keeps a business running through a hardware failure and it is genuinely worth having.

It is not a backup, and the reason is simple: delete a file and it disappears from both drives instantly, because that is the entire point of a mirror. Ransomware encrypts both. A power supply that fails destructively can take both. A flood takes both. Mirroring protects against exactly one thing — a drive dying — and nothing else on the list.

So a NAS with mirrored drives is one copy in the 3-2-1 count. A good one, on good hardware, that survives the most common failure — but one. I say this to every client at handover, because the machine looks like two copies and it is not.

How I actually arrange it

The pattern I set up on every machine, in plain terms.

The working copy lives on the computers and phones people use. The server holds the second copy, automatically, without anyone doing anything — if a backup requires a human to remember, it will eventually stop happening and nobody will notice until it matters. The third copy leaves the building, either to an encrypted copy at a provider or to a drive that physically lives somewhere else and gets swapped on a schedule.

Two properties of that third copy matter more than where it is. It must be encrypted before it leaves, so that where it ends up becomes a question about durability rather than confidentiality. And it must keep history — versions going back, so that a file quietly corrupted two months ago can still be recovered from before the corruption. A backup that only holds the current state has already copied your problem.

The step that actually decides whether this works

A restore you have never performed is not a backup. It is a belief about a backup, and the two are distinguished only on the day you need one of them.

I have encountered backups that had been running faithfully for years and were unusable: an archive that copied an empty folder because a path changed, an encrypted set whose passphrase nobody had written down, a job that had been failing silently for eleven months because its notification emails were going to an address that no longer existed. Every one of those looked fine from the outside. Every one was discovered at the worst possible moment.

So the practice, and it takes twenty minutes twice a year: pick a file at random, restore it from the oldest copy you keep, and open it. Not check that the backup ran — open the file. If you cannot do that, you do not have a backup, regardless of what the status page says.

The family from the shoebox now has three copies, two kinds of storage, one of them at a relative's house, and they have restored a photograph from it once, with me sitting there, so that they know it works. That last part took ten minutes and it is the only part of the arrangement I would refuse to skip.