The 3-2-1 backup rule still works at home

Backup advice gets reinvented every few years. Fancy product names change. Failure modes do not. Hard drives die, laptops get stolen, people delete the wrong folder, and ransomware encrypts whatever is mounted and writable. The old 3-2-1 rule still maps cleanly onto a household.

3 copies of anything you refuse to lose. 2 different kinds of storage or systems. 1 copy that is offsite, offline, or otherwise outside the blast radius of the computer you use every day.

What the numbers mean without jargon

Three copies means the live files on your computer count as one. You still need two more. A folder that also syncs to Dropbox, OneDrive, Google Drive, or iCloud usually does not give you three independent copies. Sync keeps the same library matching everywhere. We unpacked that trap in cloud storage sync is not a backup.

Two kinds of storage means do not keep both “backups” as two folders on the same external disk, or two shares on the same NAS. Use different media or different systems: the internal SSD plus an external drive, or an external drive plus a separate backup service that is not your day-to-day sync folder.

One offsite or offline copy means something that survives a house fire, a stolen backpack, or malware that encrypts every disk left plugged in. That can be a disk you unplug and put on a shelf, a disk stored at a relative’s place, or a true backup product whose retention lives outside your sync account.

CISA’s #StopRansomware Guide still pushes offline, encrypted backups and restore testing. That guidance is not only for companies. Households get hit too.

A practical home layout

Pick what you cannot replace: photo libraries, scanned IDs, tax returns, school work, creative projects, password vault export instructions, and any local documents that never landed in a sync folder.

A simple pattern that satisfies 3-2-1 for many people:

1. Copy 1: files on the computer you use.
2. Copy 2: a versioned backup to an external drive (Time Machine on a Mac, File History or another local backup tool on Windows).
3. Copy 3: either a second external drive kept somewhere else, or a dedicated backup service that is not the same as your everyday Drive/Dropbox/OneDrive/iCloud library.

Unplug the backup disk when the run finishes when you can. An always-connected disk is convenient and also easier for malware to reach.

Restore tests beat green checkmarks

A backup app that shows a happy icon is not proof. Once a month, restore one old photo or PDF to the Desktop from the backup disk or backup product. If that path is confusing today, it will be worse during a real panic. The same habit shows up in our verify your backups write-up; the drill works at home.

Do this

1. Write down the three places your irreplaceable files live. If you can only name one, you are not done.
2. Add an external-drive backup this week and let the first full pass finish.
3. Add one offsite or offline copy (second disk elsewhere, or a separate backup product).
4. Turn on MFA for the accounts that own cloud copies.
5. Restore one file on purpose, then put the disk away.

Do not do that

• Do not call sync “my 3-2-1 plan.”
• Do not keep both backups on the same single NAS volume and call it two media.
• Do not leave the only backup disk permanently mounted on the laptop that also runs your sync client.
• Do not wait until the laptop dies to learn how restores work.

How this pairs with cloud sync

Keep using iCloud Drive, OneDrive, Google Drive, or Dropbox for the files you want on every device. That habit is still useful. Just stop counting it as two of your three copies. A clean mental model:

• Sync = same files, many places, changes travel
• Backup = older points in time you can restore

When ransomware or a bad delete hits a synced folder, every online client can inherit the damage. The offline disk you unplugged last night, or the backup product with retention outside that sync account, is the copy that still has last month’s wedding photos.

If money is tight, start with one external drive and a calendar reminder to rotate it offsite weekly. Perfection is optional. A single tested external backup already beats a folder people only call a backup.

Bottom line

3-2-1 survives because it matches how things break: you need more than one copy, on more than one kind of storage, with at least one copy outside the everyday blast radius. Use sync for access. Use real backups for undo. Test a restore. That is enough structure for a home setup without buying enterprise theater.