A reliable backup plan does not need to be complicated. This practical 3-2-1 backup checklist shows how to protect computers, photos, and work files with a combination of local storage, cloud services, removable drives, and off-site copies—and how to verify that your backups can actually be restored.
Overview
The 3-2-1 backup rule is a planning framework: keep at least three copies of important data, use at least two different types of storage or media, and keep at least one copy in a separate location. The goal is not to prescribe one product. It is to reduce the chance that a single failure—such as a dead drive, stolen computer, damaged home, accidental deletion, or ransomware—removes every copy at once.
For example, a home office might keep the working files on a computer, a scheduled backup on an external drive, and an encrypted cloud backup. Those copies use more than one storage method, and the cloud copy is separated from the computer and local drive. Another approach could combine a computer, a NAS, and a removable drive stored elsewhere. A NAS can improve convenience and centralize household backups, but it should not automatically be treated as an off-site backup.
Start by listing what would be difficult or impossible to replace. This may include tax records, project files, source code, family photos, videos, device configurations, password-manager recovery information, and documents stored on phones or removable cards. Separate irreplaceable data from replaceable applications and operating-system files; a full image may be useful for a quick recovery, while personal files usually deserve the highest priority.
Capacity planning should include the current data set, previous versions, and room for growth. A backup drive that is almost full may stop retaining useful history. Before buying storage, review our guide to external SSD versus HDD for backups, media, and large files. An SSD can be convenient for frequent transfers, while a hard disk may offer more capacity for a larger local archive; the right choice depends on workload, portability, budget, and how often the drive is connected.
Checklist by scenario
One primary computer
- Enable the operating system's built-in backup or file-history feature where it meets your needs.
- Connect an external drive for scheduled local backups. Configure versioned backups if the software supports them.
- Add a cloud backup or cloud storage workflow for files that must survive loss of the computer and local drive.
- Encrypt the external drive and cloud backup when the selected tool supports encryption. Store recovery keys separately and securely.
- Disconnect or otherwise isolate a local backup when it is not being used, if your workflow permits. A permanently connected drive is convenient but can be exposed to the same malware or user error as the computer.
Photos and videos from phones or cameras
- Choose one primary library rather than leaving important images scattered across phones, memory cards, and messaging apps.
- Turn on automatic upload only after checking the service's storage limits, retention behavior, account security, and original-quality settings.
- Keep a second copy on a computer, external drive, or NAS. Do not erase a camera card until the files have been copied and checked.
- Use a separate copy for older projects or finished albums, and label folders with dates or clear project names.
- For camera cards, confirm that the card's capacity and speed are compatible with the camera. Our microSD card guide covers the same kind of compatibility checks for devices that use microSD storage.
Work files, development projects, or creative projects
- Identify the active project directory, local databases, configuration files, and any assets stored outside the main folder.
- Use frequent versioned backups for active work. A daily schedule may be adequate for less active files, while changing source code, client work, or production assets may justify more frequent protection.
- Keep a separate copy of critical repositories or project exports. A synchronized folder is useful for access, but synchronization can also replicate deletions or unwanted changes; it is not a complete backup by itself.
- Document how to restore the tools needed to open the files, including licenses, export formats, dependencies, and encryption credentials.
- Test restoring a sample project to a separate folder or computer before relying on the process.
Household or small-office storage
A NAS can centralize backups for several computers and provide a convenient local archive. Configure user permissions, update the NAS according to its maintenance guidance, and use drive redundancy only as a way to improve availability—not as a replacement for backup. Keep another copy outside the NAS, ideally off-site. See our guide to the best NAS considerations for home backup and media streaming when comparing capacity, drive bays, backup software, and restore options.
| Option | Useful for | Double-check |
|---|---|---|
| External HDD | Large local archives and scheduled backups | Physical storage, drive health, encryption, and available capacity |
| External SSD | Portable backups and frequent file transfers | Connector compatibility, durability, and enough space for backup history |
| Cloud backup | Off-site protection and automated access | Storage limits, recovery process, encryption, and account recovery |
| NAS | Centralized backups for multiple devices | Permissions, updates, redundancy, and a separate off-site copy |
| Removable drive stored elsewhere | Offline or off-site rotation | Rotation schedule, labeling, environmental storage, and encryption |
What to double-check
Use this fill-in planning template before choosing hardware or a service:
- Data to protect: ______________________________
- Current data size: ______________________________
- Expected yearly growth: _________________________
- Maximum acceptable data loss: _________________
- Maximum acceptable downtime: _________________
- Local backup location: __________________________
- Off-site backup location: ________________________
- Backup schedule: _______________________________
- Encryption and recovery-key location: ___________
- Next restore test: ______________________________
Check that every device is included. Laptops, desktops, phones, tablets, game consoles, camera cards, USB drives, and NAS shares may each hold different data. Also verify whether the backup tool includes application data, browser profiles, email archives, virtual machines, and hidden project directories.
Review cloud settings rather than assuming that “sync” means “backup.” Look for version history, deleted-file recovery, file retention, multi-factor authentication, and a method for downloading data if the service is unavailable. For sensitive information, understand whether encryption keys are controlled by you, the provider, or both. If a service offers ransomware detection or immutable storage, confirm how those features work and what plan or configuration they require.
Perform a restore test in a safe location. Restore a few ordinary files, one older version, a folder with many files, and—if relevant—a complete project. Open the restored files, check their names and dates, and record how long the process takes. A backup that cannot be located, decrypted, or opened is not a dependable recovery plan.
Common mistakes
- Keeping every copy beside the computer: A theft, fire, spill, or power event can affect all local devices.
- Treating RAID or drive redundancy as backup: Redundancy can help a system keep running after a drive failure, but it does not protect against deletion, corruption, theft, or malware by itself.
- Backing up only the operating system: Personal files, application data, project folders, and phone photos may be stored elsewhere.
- Never testing restoration: Failed drives, expired accounts, damaged archives, missing keys, and incorrect permissions often appear only during recovery.
- Using one password or one recovery path: Secure backups require a way to recover accounts and encryption keys without leaving those credentials in the same place as the data.
- Letting backups fill the drive: Set a retention policy and review whether older versions are still useful before capacity becomes an emergency.
- Assuming automation is working: Check backup reports, recent completion dates, available capacity, and error messages.
When to revisit
Review the plan at least monthly by checking the latest successful backup, free capacity, account alerts, and whether new devices or folders have been added. Perform a restore test quarterly, or more often for data that changes quickly or supports paid work. Rotate an off-site drive according to a written schedule rather than relying on memory.
Revisit the plan before seasonal planning cycles, after buying a new computer or phone, when changing cloud providers, after a major operating-system update, or when a project creates a large increase in data. Replace or reassign storage before it reaches its practical capacity, and update the plan when encryption settings, backup software, or account-recovery methods change.
For a practical next step, choose one important folder today, make a local copy and an off-site copy, then restore one file from each. Record where the copies live, when the next backup runs, and who can access the recovery credentials. Repeat that process until the plan covers every device and data set that matters.
