Backup strategy: a 3-2-1 plan for your family's files and photos

Malware / security. Updated 2026-09-13. About 5 minutes to read.

Keep three copies of important files on two kinds of storage with one off-site, make sure at least one copy is offline or versioned, and test a restore every three months.

A good backup turns ransomware, a stolen laptop or a dead hard drive into an annoying afternoon instead of a permanent loss. Most people believe they already have one because their photos go to iCloud, Google Photos or OneDrive. Those services mostly sync, and sync copies your mistakes as faithfully as your files.

This guide sets out the 3-2-1 rule, explains why at least one copy should be offline or versioned, and walks you through a simple setup on Mac and Windows. It finishes with the step almost everyone skips: testing that you can actually restore.

The 3-2-1 rule in plain terms

Australia's ACSC puts the offline part plainly: ransomware and other malware have been known to infect backup files by spreading to connected hard drives or cloud storage, and a backup that is not connected to any device or network is one you can always restore from.

3 copies of your data: the original plus two backups.
2 different kinds of storage, such as your computer plus an external drive, or an external drive plus a cloud backup service.
1 copy kept off-site, so a fire, flood or burglary cannot take every copy at once.
Many security teams add one more rule: at least one copy offline or unchangeable, where ransomware cannot reach it.

Why sync is not a backup

iCloud Drive, OneDrive, Google Drive and Dropbox mirror your folders. Delete a file on your laptop and it disappears from the cloud. If ransomware encrypts your documents folder, the encrypted versions sync up too.

Version history helps, but it has limits. Google Drive says a file version may be permanently deleted after 30 days or once there are 100 newer versions. OneDrive's Restore your OneDrive feature lets Microsoft 365 subscribers roll back files and folders to a point in the last 30 days. If you notice a problem after that, the good versions are gone.

Keep syncing for convenience, but do not count it as one of your three copies unless the service keeps long version history you have checked.

Decide what actually needs protecting

Photos and videos, which cannot be recreated.
Tax returns, property, legal, medical and study documents.
Business files, accounting data and client records if you work from home.
An encrypted export from your password manager and printed recovery codes for your most important accounts.
Email stored only in a desktop program rather than on the provider's server.
Not needed: apps and the operating system, which you can reinstall.

Set up a local, versioned backup

Buy an external drive with at least twice the space your files use today.
On a Mac, connect the drive, open System Settings, then General, then Time Machine, and add it as a backup disk. Tick the option to encrypt the backup.
Time Machine keeps hourly backups for the past 24 hours, daily backups for the past month and weekly backups for older months, deleting the oldest when the disk is full.
On Windows, connect the drive, search for File History in the Start menu, open it and turn it on for that drive. It keeps earlier versions of files in your libraries, desktop and other folders.
On Windows, encrypt the drive with BitLocker To Go on editions that include it, and store the recovery key in your password manager. On a Mac, the Time Machine encryption option does this for you.
Label the drive with its purpose and the date, and eject it once the backup finishes if it is your offline copy.

Add an off-site copy

You have two practical choices. A cloud backup service copies your computer to its servers on a schedule and keeps old versions. Check the version retention period and whether you can set a private encryption key, and remember that losing that key means losing the backup. Prices change often, so compare current plans on each provider's site.

The other choice costs nothing extra: two external drives. Keep one at home and one at a relative's house or your workplace, and swap them every month. The ACSC suggests exactly this kind of rotation so one copy is always offline.

Phones: turn on iCloud Backup or Google One backup, and copy photos to your computer every few months so they reach your drive backups too.
Shared family photos: pick one person's computer as the collection point so everything lands in one backed-up place.

Test your restores

Every three months, restore one random file from an older version and open it.
Check the date of the last successful backup on every drive and cloud service, and turn on failure alerts where they exist.
Once a year, restore a whole folder of photos to a spare location and spot-check that images and videos open.
Before replacing a computer, confirm you can restore to the new one before you wipe the old one.
Write the test date in your calendar note or password manager so you know when you last proved it works.

The ACSC recommends regularly trying to restore your backups. A backup you have never restored is only a hope.

A simple plan for a typical household

Each computer backs up automatically to its own encrypted external drive with Time Machine or File History.
A second drive, or a cloud backup service, holds an off-site copy updated at least monthly.
Phones back up to iCloud or Google, and photos are copied to a computer each season.
Printed recovery codes and the backup encryption keys are stored somewhere safe that someone you trust can find.
A restore test every three months, with a calendar reminder.

Frequently asked questions

How often should I back up?

Automatically and at least daily for the computer you use most. Time Machine and File History can run hourly. Rotate or update your off-site copy at least monthly.

Is cloud storage enough on its own?

Usually not. Sync services copy deletions and encrypted files, and version history is often limited to about 30 days. Add an offline or long-retention backup.

Should I encrypt my backups?

Yes. A backup drive holds everything a thief would want. Encrypt it and keep the password or recovery key in your password manager and somewhere offline.

How long do external hard drives last?

Drives fail without warning, sometimes after a few years. Replace drives that report errors, keep two backup copies, and do not rely on a single old drive.

Can ransomware encrypt my backup drive?

Yes, if the drive is connected when the ransomware runs. That is why one copy should be disconnected except while backing up.