Setting Up 3-2-1 Backups for Real Not Just in Theory

Most people can recite the 3-2-1 rule by now. Three copies of your data, on two different kinds of storage, with one copy somewhere else. Great. Then you ask them where their third copy lives and it gets quiet.

The rule is easy. Actually setting it up is the part people put off, so here's how I'd do it without turning it into a weekend project.

Copy one is the stuff you already have

The files on your laptop or desktop count as copy one. That's it. You don't need to do anything here except know where your important stuff actually lives. Documents, photos, project folders, your password manager's export if you keep one, any config files you'd hate to rebuild.

Take five minutes and write that list down. Half of backup problems come from backing up the wrong folders and finding out later.

Copy two goes on a drive in the same building

This is your fast, local backup. It's the one you'll use when you delete the wrong folder on a Tuesday afternoon.

An external drive is the easiest option. On a Mac, plug it in and turn on Time Machine. On Windows, File History does a similar job. Both keep versions over time, which matters more than people think. If ransomware encrypts your files or you save over a document with garbage, you want yesterday's version, not just the latest one.

If you've got a NAS, that works too, and it has the advantage of backing up every computer in the house to one place. Just remember a NAS sitting next to your desk is still in the same building. It's copy two, not copy three.

One habit worth building: if you use an external drive, don't leave it plugged in forever. A drive that's always connected can get hit by the same ransomware that hits your computer. Plug it in for the backup, then unplug it.

Copy three has to leave the house

This is the one that protects you from fire, flood, theft and the kind of bad day that takes out everything in one room. You've got a few options.

A cloud backup service. These run quietly in the background and upload your files to their servers. It's the lowest effort option by far. Pick one that offers versioning and, ideally, lets you set your own encryption key so the provider can't read your files.

Encrypted backups to storage you control. If you self-host or just like knowing exactly what's going on, a tool like restic does this really well. It encrypts everything before it leaves your machine, deduplicates so repeat backups are small, and can send to S3-compatible storage, another server over SFTP, and plenty of other places.

A basic restic setup looks like this:

# one time: create the repository (you'll set a password)
restic -r sftp:backup@your-server:/srv/restic init

# run this on a schedule
restic -r sftp:backup@your-server:/srv/restic backup ~/Documents ~/Pictures

# keep a sensible history and clean up the rest
restic -r sftp:backup@your-server:/srv/restic forget \
  --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Put the backup and cleanup commands in a cron job or scheduled task and it runs on its own. Store the repository password in your password manager. Lose that password and the backup is unreadable, which is exactly the point, so don't lose it.

A drive at another location. Old school, but it works. Keep a second external drive at work or at a family member's place and swap it every month or so. The catch is it's only as current as your last swap, and humans are bad at monthly chores.

The step everyone skips

Test a restore. Seriously.

A backup you've never restored from is a guess. Pick a random file, restore it somewhere harmless, and open it. With restic it's one command:

restic -r sftp:backup@your-server:/srv/restic restore latest --target ~/restore-test

With a cloud service, use their restore feature and download a folder. With Time Machine, go back a week and pull out a file.

Do this right after you set things up, then put a reminder on your calendar every few months. It takes ten minutes and it's the only way to know the whole thing actually works.

What it looks like when you're done

Your files live on your computer. An external drive or NAS keeps versioned copies locally. An encrypted copy sits offsite, updated automatically. And you've restored from both at least once.

That's 3-2-1 for real. It's not glamorous, but the day a drive dies, you'll shrug instead of panic, and that's worth an afternoon.