The Backup You Think You Have: Building 3-2-1-1-0 Properly
The Backup You Think You Have: Building 3-2-1-1-0 Properly
Almost everyone reading this has a backup. Almost nobody reading this has tested it. Those two facts are the entire problem, and they explain why the standard advice — keep three copies, on two kinds of media, with one off-site — keeps failing people who followed it to the letter.
The 3-2-1 rule was written for a world where the thing that destroyed your data was a dead disk or a house fire. Both are indifferent to where your backup lives. Ransomware is not. It looks for backups on purpose. The joint #StopRansomware Guide — authored by CISA with MS-ISAC, the NSA and the FBI — is blunt about why offline copies matter: many ransomware variants, it says, attempt to find and then delete or encrypt any backup they can reach, specifically to make restoration impossible unless the ransom is paid.
That is the gap the modern version closes. 3-2-1-1-0 keeps the original three numbers and adds two: one copy that is immutable or logically air-gapped, and zero errors on a verified recovery. This guide builds that, end to end, on a normal home or freelance setup. Budget about ninety minutes of attention plus whatever your first upload takes overnight.
01. Decide what you are actually protecting
Open a text file and write down what would genuinely hurt. For most people the honest list is short: photos and video, documents and tax records, code and design files, password manager exports, and the configuration of anything you would hate to rebuild from memory. Applications are not on that list. Operating systems are not on that list.
This matters because the size of that list sets the cost of every later step. People who try to mirror an entire 2 TB drive off-site quietly abandon the plan when the first bill arrives. People who identified 180 GB of irreplaceable material keep paying for it for a decade.
Cost: the drive, plus roughly $7 per terabyte per month off-site.
Time: 90 minutes of setup; the first upload runs unattended.
02. The local copy, and the setting almost everyone skips
On a Mac, this is Time Machine. Apple's own guidance is specific about capacity: use a storage device with at least twice the capacity of your Mac — 2 TB of backup disk for a 1 TB machine. Apple also asks that the disk be used only for Time Machine, unless you are comfortable splitting it into a separate APFS volume.
The step to not rush past is the encryption prompt during setup. If you turn on Encrypt Backup, macOS asks you to create a backup password, and you will need that password later to restore anything. An unencrypted backup disk is a copy of your entire life that anybody can read by plugging it into their own machine.
On Windows, File History does the same job against an external drive, and restores through the taskbar search for Restore your files with File History — where the arrows step through previous versions of a file and a right-click on Restore lets you send it somewhere other than its original location. That last detail is worth remembering: restoring in place overwrites the thing you are trying to compare against.
03. The off-site copy, priced honestly
A second drive in the same drawer as the first is not an off-site copy. Flood, fire, burglary and a single bad power event all take both. The off-site copy can be object storage, a consumer backup subscription, or a drive you physically rotate to a relative's house — the requirement is geographic separation, not sophistication.
Object storage is the most predictable of the three because it is priced per terabyte. Backblaze B2 publishes a starting rate of $6.95 per terabyte per month, with free egress up to three times the amount you store and no minimum file size or storage duration fees — that last clause matters for backup, where small files churn constantly. We ran that rate across the data sizes people actually have:
| Data you protect | Local disk (2× rule) | Off-site, monthly | Off-site, per year |
|---|---|---|---|
| 500 GB | 1 TB | $3.48 | $41.70 |
| 1 TB | 2 TB | $6.95 | $83.40 |
| 2 TB | 4 TB | $13.90 | $166.80 |
| 4 TB | 8 TB | $27.80 | $333.60 |
| 8 TB | 16 TB | $55.60 | $667.20 |
The comparison that makes the decision for most households is the first row against the last. Protecting the 500 GB that genuinely cannot be recreated costs less per year than a single month of most streaming bundles. Mirroring eight terabytes of media you could re-download costs sixteen times that. The list you wrote in step one is what separates those two outcomes.
04. The first "1" — a copy that cannot be deleted
This is the number that did not exist in the original rule, and it is the one that survives a modern incident. CISA's guidance is explicit on both halves of it: enable delete protection or object lock on storage resources commonly targeted in ransomware attacks, and consider enabling version control so multiple variants of each object are retained. Object lock means a copy cannot be deleted or overwritten before its retention window expires, even by an account with full permissions.
Why that is not paranoia: the same guide's threat-hunting section lists the Windows tools ransomware operators reach for to stop you recovering — vssadmin.exe, wbadmin.exe, bcdedit.exe, fsutil.exe deletejournal and wmic shadowcopy. Destroying shadow copies and local backup catalogues is described there as a common technique to inhibit system recovery. An always-connected external drive and a Windows restore point sit squarely in that blast radius.
One caveat, and it is CISA's own rather than ours: immutable storage should be used with care, because it does not satisfy every regulatory regime and a misconfigured retention policy can impose significant cost. Set a retention window you can afford to be stuck with — thirty to ninety days suits most personal archives — rather than the longest one the interface offers.
05. The "0" — proving it works
CISA's preparation advice pairs those two ideas in a single line — maintain offline, encrypted backups, and regularly test both the availability and the integrity of those backups in a disaster recovery scenario. Availability and integrity are different properties, and consumer backup software tends to report on neither.
Integrity first. If you use restic, the check command verifies the structural consistency of the repository. Its documentation demonstrates the failure mode plainly: corrupt one index file and a later restore dies with an "invalid data returned" error — but running check surfaces that damage before you ever need the data. Verifying the actual contents requires the --read-data flag, which downloads every pack file and therefore costs bandwidth. The practical compromise is built in: --read-data-subset=1/5 through 5/5 divides the repository into five groups, so five monthly runs cover everything without ever paying for a full download at once.
Availability second, and this one you cannot automate. Once a quarter, pick a file you have not touched in months, restore it to a new location rather than over the original, open it, and confirm it is the file you expected rather than a zero-byte placeholder or a version from 2019.
| Test | How often | Passing looks like |
|---|---|---|
| Structural check of the archive | Monthly | "no errors were found" |
| Content read, one fifth at a time | Monthly, rotating 1/5 to 5/5 | Full coverage every five months |
| Restore a real file to a new folder | Quarterly | File opens; contents are current |
| Confirm off-site copy is current | Quarterly | Newest snapshot dated this week |
| Confirm the encryption password works | Annually | You restored without resetting it |
06. What goes wrong, and who should skip this
The disk fills and you are not told loudly. Apple states that the oldest backups are deleted once the backup disk is full. Nothing breaks; your history just quietly gets shorter. This is the entire justification for the 2× capacity rule, and the reason to glance at the drive's free space once a quarter.
The encryption password is gone. An encrypted Time Machine disk cannot be read without the password you set at setup, and no support call recovers it. Store it in a password manager whose own recovery kit is printed on paper somewhere else.
Sync is not backup. A cloud drive that mirrors your folders will faithfully mirror a deletion, and will faithfully mirror a file after ransomware has encrypted it. Versioning helps, but only within whatever retention window the provider grants, and only if you notice in time. The immutable copy in step four exists precisely because sync does not do this job.
Every backup guide we read while researching this piece treats the five numbers as equally weighted steps in a checklist. They are not. Four of them are purchases, and one is a habit — and the industry has spent twenty years optimising the four it can sell you. Drives got cheap, object storage got cheap, immutability became a checkbox. The quarterly restore drill is the only item on the list that nobody profits from, which is exactly why it is the item missing from almost every setup we have ever been asked to look at. The deeper asymmetry is that the first four numbers fail loudly and the fifth fails silently. A dead disk announces itself. A full backup disk quietly shortening your history, or an archive whose index rotted two years ago, announces nothing at all until the day you need it, which is also the day you have no time to fix it. That is why we would rather see someone run 3-2-1 with a tested restore than 3-2-1-1-0 with none. The tested restore is not the last step of the process. Functionally, it is the only step that has ever proved anything.
What we still don't know: how often consumer backup archives actually develop silent corruption in normal home conditions. Enterprise storage publishes durability figures; the external drive on your desk does not, and we have not run a longitudinal test of our own.
Audit the Extensions, Fence the Smart Devices, Run the AI Offline — narrowing the attack surface that reaches your backup drive in the first place.
Three Privacy Upgrades Worth Making Before the Weekend — where the encryption password from step two should actually live.
Sources
- CISA, MS-ISAC, NSA and FBI — #StopRansomware Guide (primary) — offline encrypted backups, availability and integrity testing, object lock and versioning, the immutability caveat, and the recovery-inhibition tooling listed under threat hunting.
- Apple — Back up your Mac with Time Machine (primary) — the 2× capacity guidance, hourly/daily/weekly retention schedule, deletion of oldest backups when full, and the Encrypt Backup password requirement.
- restic 0.19.1 documentation — Working with repositories (primary) — structural check behaviour, the "invalid data returned" failure, and the --read-data-subset rotation.
- Backblaze — B2 Cloud Storage Pricing (primary) — the $6.95/TB/month starting rate, 3× free egress, and absence of minimum file size or storage duration fees.
- Microsoft Support — Back up and restore with Windows Backup (primary) — File History restore path, version stepping, and restoring to an alternate location.
- SentinelOne — What Is the 3-2-1 Backup Strategy? — independent corroboration that 3-2-1-1-0 is the current framing of the rule.
- AvePoint — What Is the 3-2-1 Backup Rule? — second independent source for the immutable-copy and verified-recovery additions.
Prices and specifications verified September 14, 2026 and subject to change. GadgetGlow Bytes does not test hardware and did not benchmark any product named here; all figures come from vendor or government documentation, or from our own arithmetic, which is shown in full above. GadgetGlow Bytes does not receive products from manufacturers for coverage.
Comments
Post a Comment