Bay Geeks Guide · Backup & Recovery Read This First

The Backup Strategy That Actually Protects Your Files

An external drive sitting next to the computer feels like a backup. It usually isn't one, not on its own. Here's the strategy that actually holds up.

By Alden, Owner · Updated September 3, 2026

We recover data for a living, and the saddest calls aren't the ones with no backup at all; they're the ones where there was a backup, and it turned out not to actually protect against whatever just happened. Here's how to build one that does.

Why “I Have an External Drive” Isn't Enough

A single external drive plugged into the same computer, sitting on the same desk, covers exactly one failure mode: the internal drive dying on its own. It does nothing for a fire, a theft, a power surge that takes out everything plugged in at once, or a lightning strike during Florida's storm season. And if that external drive is always connected, it doesn't protect against ransomware either: malware that encrypts your files can reach anything the computer can write to, backup drive included.

The 3-2-1 Rule, Explained

The standard backup practice used across the IT industry is simple to state: 3 copies of your data, on 2 different types of media, with 1 copy stored offsite. Each part is solving a different failure:

Part of the rule	What it protects against
3 copies (the original plus 2 backups)	Any single copy being lost still leaves two others.
2 different media types	A flaw or failure specific to one storage type (say, a bad batch of drives) doesn't take out every copy at once.
1 copy offsite	Fire, theft, flood or storm damage to the building doesn't take out every copy at once.

What Ransomware Changes About This

The 3-2-1 rule predates ransomware being a common threat, and modern ransomware is designed specifically to find and encrypt anything reachable from the infected computer, including a backup drive that's always plugged in or a network share that's always mounted. The fix is versioning or true offline storage: a backup system that keeps previous versions of files (so you can roll back to before the encryption happened) or a copy that's physically disconnected most of the time. See our ransomware checklist for the fuller picture.

The DIY 3-2-1 Setup

For anyone who wants to build and manage this themselves:

Local backup: Windows File History or macOS Time Machine, backing up to an external drive, covers copy #2.
Rotate the external drive: disconnect it when it's not actively backing up, and ideally keep a second one offsite (a family member's house, a safe deposit box) that you swap in periodically. This is what makes it “offline” rather than always-reachable.
Add a cloud backup service: a continuous, versioned cloud backup covers copy #3 and satisfies the offsite requirement automatically, without you having to remember to swap a drive.
Actually test a restore at least once. A backup nobody has ever restored from is a theory, not a backup.

The “Set It and Forget It” Version

If managing rotation schedules and testing restores isn't how you want to spend a weekend, this is exactly what our maintenance plans are built to remove from your plate. Every Bay Geeks maintenance plan includes Unlimited Cloud Backup, continuous and versioned, plus proactive hard-drive health monitoring that flags a drive trending toward failure while it's still readable, which is the single biggest factor in whether a failing drive is a routine swap or a data-recovery emergency. The residential Automated plan starts at $55/month per computer.

FIXED ✓