The Backup Strategy That Actually Protects Your Files
An external drive sitting next to the computer feels like a backup. It usually isn't one, not on its own. Here's the strategy that actually holds up.
We recover data for a living, and the saddest calls aren't the ones with no backup at all; they're the ones where there was a backup, and it turned out not to actually protect against whatever just happened. Here's how to build one that does.
Why “I Have an External Drive” Isn't Enough
A single external drive plugged into the same computer, sitting on the same desk, covers exactly one failure mode: the internal drive dying on its own. It does nothing for a fire, a theft, a power surge that takes out everything plugged in at once, or a lightning strike during Florida's storm season. And if that external drive is always connected, it doesn't protect against ransomware either: malware that encrypts your files can reach anything the computer can write to, backup drive included.
The 3-2-1 Rule, Explained
The standard backup practice used across the IT industry is simple to state: 3 copies of your data, on 2 different types of media, with 1 copy stored offsite. Each part is solving a different failure:
| Part of the rule | What it protects against |
|---|---|
| 3 copies (the original plus 2 backups) | Any single copy being lost still leaves two others. |
| 2 different media types | A flaw or failure specific to one storage type (say, a bad batch of drives) doesn't take out every copy at once. |
| 1 copy offsite | Fire, theft, flood or storm damage to the building doesn't take out every copy at once. |
What Ransomware Changes About This
The 3-2-1 rule predates ransomware being a common threat, and modern ransomware is designed specifically to find and encrypt anything reachable from the infected computer, including a backup drive that's always plugged in or a network share that's always mounted. The fix is versioning or true offline storage: a backup system that keeps previous versions of files (so you can roll back to before the encryption happened) or a copy that's physically disconnected most of the time. See our ransomware checklist for the fuller picture.
The DIY 3-2-1 Setup
For anyone who wants to build and manage this themselves:
- Local backup: Windows File History or macOS Time Machine, backing up to an external drive, covers copy #2.
- Rotate the external drive: disconnect it when it's not actively backing up, and ideally keep a second one offsite (a family member's house, a safe deposit box) that you swap in periodically. This is what makes it “offline” rather than always-reachable.
- Add a cloud backup service: a continuous, versioned cloud backup covers copy #3 and satisfies the offsite requirement automatically, without you having to remember to swap a drive.
- Actually test a restore at least once. A backup nobody has ever restored from is a theory, not a backup.
The “Set It and Forget It” Version
If managing rotation schedules and testing restores isn't how you want to spend a weekend, this is exactly what our maintenance plans are built to remove from your plate. Every Bay Geeks maintenance plan includes Unlimited Cloud Backup, continuous and versioned, plus proactive hard-drive health monitoring that flags a drive trending toward failure while it's still readable, which is the single biggest factor in whether a failing drive is a routine swap or a data-recovery emergency. The residential Automated plan starts at $55/month per computer.
Want the Backup Handled For You?
Unlimited Cloud Backup and drive monitoring come standard on every maintenance plan. Set it up once, and stop thinking about it.
More Guides
Run it: separate profiles for copper and fiber, plus latency under load.
What download, upload, latency, jitter and bufferbloat each actually tell you.
The issues we see most often in Tampa Bay homes, and what to try first.
Why the mesh kit didn't fix it, what's really blocking the signal, and the fix that holds.
Which cable fixes are cosmetic and which ones are bend radius, EMI or fire-safety issues.
UPS topology, waveform and sizing math, explained without the marketing numbers.
What to stop doing, and do next, when a drive starts clicking or won't mount.
How to know which type of service gets you fixed faster.
What proactive support actually saves you compared to calling only when something breaks.
How a monthly maintenance plan pays for itself in prevented downtime.
The proactive steps that keep your business off the list of ransomware victims.
How to tell when antivirus alone isn't covering you anymore.
What managed detection & response catches that antivirus can't.
Why a stolen password is now the most common way in, and how it's stopped.
What HIPAA, PCI DSS and NIST reporting should actually look like.
A quick check on whether your current IT setup is costing more than it should.
What actually happens during a remote session, step by step.
The three layers of cyber threats, and which one actually hits home users and small businesses.
California's DROP tool plus the DIY opt-out list for every other state, and when it's worth letting us drive.
Real, upfront rates for computer repair and managed IT services: no hidden fees.
The real symptoms of malware, the ones that usually turn out to be something else, and what's safe to check...
Startup bloat, a near-full drive, an aging HDD, or something else entirely: how to find the real cause of a...
A straight decision framework: when a repair clearly wins, when replacement clearly wins, and the hidden...
Straightforward hourly rates, what typical jobs actually run, and what makes a repair cost more or less. Real...
That full-screen warning with a phone number is not from Microsoft. Here's how to close it safely, without...
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service