How to back up your files
Backing up means keeping three copies of anything that matters, on two different kinds of media, with one of those three copies somewhere outside your home or office. What makes the plan real is not buying a drive or installing software; it is restoring one file from the backup, once.
- Lesson 10 of 12
- Beginner
- Free, no signup
The three layers that complete a backup plan
Read it from the base upwards and the name of the rule appears: three, two, one. Each layer covers a different kind of disaster, and a lower layer does not replace an upper one.
-
1
One copy outside the building
For the event that takes the whole place: theft, fire, flood, or the bag that held everything.
-
2
Two different kinds of media
Two drives of the same age bought together count as one medium; failures have patterns.
-
3
Three copies of anything that matters
The file itself plus two copies. The file you work on every day is one of the three.
This is a rule of thumb, not a standard. For one person with a laptop it is usually enough; for a business, retention duties and contracts get added on top.
Last checked: Facts and tool names in this lesson are re-checked against their sources on this date.
First decide what you will not lose
Most backup plans die at this step, because people try to keep everything, get scared by the size, and then give the whole thing up. Everything is not required.
Your files come in two kinds. The first kind can be obtained again: program installers, films and music you bought, anything downloaded once that can be downloaded again. The second kind cannot: family photos, scanned documents, years of work, messages, project files for a client you can no longer reach.
Back up only the second kind. For most people that is less than they expect, often a few dozen gigabytes, and it is exactly that smallness which makes the plan runnable. Write a short list on paper: four or five folders, no more.
One question helps. If the laptop disappeared right now, which folder would hurt? That one.
What the 3-2-1 rule says
The rule people in the trade call 3-2-1 asks for three things: three copies of every important file, on two different kinds of media, with one copy kept away from wherever the others are.
Three copies means the file itself plus two copies. Two kinds of media means not all three on the same sort of device, because failures have patterns: two drives of the same age, bought together, can fail close together. And one copy elsewhere is for the event that takes the whole place: theft, fire, flood, or just the bag that held both the laptop and its backup drive.
This is not a standard, it is a rule of thumb, and its value is that you remember it. The UK National Cyber Security Centre puts the same idea more plainly in its guide for small organisations: consider using online storage and a storage device to create two backups, in case one of them is lost or stolen. The same page carries another sentence that matters more, and the next section is about it: the device should not stay connected to your device when it is not in use.
A real plan for one person
This plan is written for one person with a laptop and a phone. If you run a company or a server, your job is different, and the end of this lesson says where to go.
The original is the files you work with every day, on the laptop and the phone. That does not count as a copy; it is the thing we are trying to save.
The first copy goes on an external drive. Plug it in once a week, copy or sync the files, and unplug it. Leaving it attached permanently is the mistake the British guidance above warns about, and the reason is simple: whatever hits the computer, from ransomware to a power fault, also hits whatever is attached to it.
The second copy lives outside the house. A cloud account is the simplest shape and is enough for most people. If you would rather the files never leave home, the other shape is a second drive kept at your workplace or a relative house, swapped once a month. It is slower, but a copy updated monthly is infinitely better than a copy that does not exist.
Do not treat the phone as separate. Your photos are probably there, and automatic photo sync is the trap described in the cloud storage lesson: a photo you delete on the phone is deleted from that account too.
One last decision people forget: how often? Get the answer from how many days of work you are willing to redo. If the answer is one day, you need a daily backup. If it is a week, weekly is fine. Take the number from your own habits, not from somebody else recommendation.
The one person plan, from the list to the first restore
-
1
The short list
Four or five folders that cannot be replaced. Anything downloadable again stays off the list.
-
2
The copy on a drive
Plug in once a week, copy, then unplug. Unplugging is the important part of this step.
-
3
The copy off site
A cloud account, or a second drive kept at work and swapped once a month.
-
4
Do not leave the phone out
The photos are there, and automatic photo sync is not a second copy; it is the same copy.
-
5
Restore one file
And open it. Until you do, what you have is a folder, not a backup.
These five steps are for one laptop and one phone. Sites and servers take a different shape from step two onwards, and this lesson says where to go for those.
A backup that was never restored is not a backup
This is the one sentence in this lesson we say flatly, because we have run into it too many times. Until you have restored something from a backup, what you have is a folder that is probably a backup.
The NCSC guidance says the same: it is important you know how to restore it, and to check that it contains all your important data. Notice those are two separate jobs. One is knowing how. The other is checking what is inside.
A restore drill on a personal laptop takes ten minutes. Restore one file from the backup into a temporary folder and open it. A photo should display, a document should have text in it, a project file should open in the program it belongs to. Looking at the file size is not a test; a half written file also has a size.
Once a year, do the same at a bigger scale: a whole folder. If restoring needs a password, that is the moment you learn whether you have it or only thought you did. A lost password on an encrypted backup has exactly the same effect as having no backup.
The restore drill, once a year
This counts as tested
- You restored into a temporary folder, not over the original
- You opened it and the contents were right
- You had the password or key it needed, right then
- Once a year, a whole folder and not just one file
This is not a test
- Looking at the file size or the number of files
- Seeing a green success message in the software
- The fact that it worked last year
This sheet is for personal files. Restoring a site or a database has its own stages, and one opened file proves nothing there.
Where a backup will not help you
There are three situations people believe they are covered for and are not.
Ransomware on a copy that is attached. If the backup drive is always plugged in, or the backup lives only inside a synced folder, malware reaches both. Keeping the medium separate is the only thing that breaks this.
Corruption nobody noticed for months. If a file was damaged six months ago and your backup keeps only the latest version, you have been backing up the damage for six months. Dated versions solve that, and every cloud service has its own window for how long old versions are kept.
An account that will not open any more. A backup on an online account is exactly as reachable as that account. A password, a verification code and the company own decision all stand between you and your files.
And one boundary this lesson does not cross: website backups. A WordPress site backup is not only files, it is a database too, and restoring it is a different job. If you run a site, our hosting page is where the two are handled together, and the WordPress migration guide shows the practical shape of it.
The fast path, with AI
What most backup plans are missing is not software, it is one sheet of paper: when the laptop is gone, where do you start. The fast path is to have a language model build that sheet <em>from the disaster end</em> rather than the tool end. You can see the difference in the output: the ordinary answer is open the program and click restore; the right one starts from it is nine in the morning, the laptop is gone, and all you have is your phone.
- Write a plain list of your own situation: which devices you have, where the backup lives, and which accounts are needed to reach it. Do not write passwords or recovery codes; only say what is needed.
- Send the recipe below with that list. A fast cheap model is enough here, because this is ordering rather than technical judgment. The current pick in each model class is kept, with its date, in <a class="text-link" href="/en/ai/">our AI section</a>.
- Read the answer and mark every step that needs an account. Now test those accounts: sign in, and see where the verification code arrives. This is usually where you discover that the recovery number on file is no longer yours.
- Keep the finished sheet somewhere that survives the disaster it describes: printed on paper, or in an account you can open from the phone as well. A sheet that lives only inside the dead laptop does nothing.
Copy-ready recipe
I want you to write a one page recovery sheet for me. Start from the disaster end, not the software end.
My situation:
Devices: {for example one Windows laptop and one Android phone}
Where the backup is: {for example an external drive in a drawer, and a cloud account}
What is needed to reach the backup: {for example signing in to that account and an SMS code}
What matters most: {for example photos, documents, the work folder}
Scenario: the laptop is gone as of right now. It is nine in the morning and all I have is the phone.
Give the output exactly like this:
First 24 hours: {numbered list, one sentence per step}
What I need and where I get it: {list}
What is lost with no way back: {list, honestly}
What I should fix today: {short list}
Rules:
1. Use only the situation I wrote above. If you do not know something, write "needs checking" instead of guessing.
2. Do not give me any command whose effect you cannot explain in one sentence.
3. Mark every step that deletes or formats anything with the word "irreversible".
4. No preamble and no conclusion. Only those four parts.Before you trust the output: The model does not know which of your accounts still opens or which number is still yours; it assumes all of that from what you wrote. So every line that mentions an account or a verification code has to be tested by you, the same day. And keep the sheet somewhere that survives the disaster it describes; a sheet that lives only inside the laptop is unreachable exactly when it is needed.
AI in this kind of work
In backups, the best thing AI does is not telling you which program to buy. It is organising your thinking: asking what cannot be replaced, ordering the steps, and writing the sheet you never find time for. Our position is to use it for the plan, not for the tool choice.
Tools that actually help
- Claude For building the recovery sheet and finding the missing steps in a plan you wrote yourself. Iran is not on Anthropic supported countries list, which we read on their own page.
- Gemini The same job, and closer to hand for reading your own cloud service help pages. Google own page says the Gemini web app runs in over 230 countries, and Iran is not on that list.
Where it backfires
There are two specific risks here and we have seen both. First, disk commands. Ask a model how to prepare a drive for backups and it may hand you a command that wipes a partition, and because it is written with confidence it looks harmless. The rule is simple: do not run a command you cannot explain in one sentence, especially one that names a disk. The troubleshooting lesson goes further into this. Second, file contents. A business folder listing carries client names and invoice numbers and does not need to enter any chat; for writing a recovery sheet, broad categories are enough. Google own page on Gemini says plainly not to enter confidential information, and adds that with activity on, a human reviewer may read a conversation and the reviewed copy is kept for up to three years.
Sources: Google: how Gemini Apps activity and data are used Anthropic: supported countries Google: where the Gemini web app is available
Where this advice stops
This plan was written for one person personal files and stops being enough past a point. A site or server backup includes a database and the order you restore in matters; a company backup is tied to retention duties and to several people access, and it is no longer a technical decision. There is another boundary that gets said less often: if you encrypt the backup and lose the key, the result is exactly the same as having no backup. The key needs a backup too.
From our own work
We back up seven sites on this server and send the copies to cloud storage, and the plugin that does it carries two lessons, both bought at a price. First, done means a checksum was read and matched the original, not that the file finished uploading; before that rule existed, the program re-verified a file it had already deleted, twelve times, and reported a size mismatch instead of the real reason. Second, an error message is not evidence. A branch that concluded from one word in an error text that the transfer session was dead threw away a 4.5 GB transfer at 49.7 percent on one of the sites; now we ask the service itself how many bytes it holds and continue from there. Both say the same thing: a backup that has not proven itself is only a claim.
Real follow-up questions
Is one external drive not enough?
It is enough for a laptop failure and not for theft or fire, because the drive is usually in the same house. One copy outside the building is what covers that case. If you can only take one step, take that second one.
Should I encrypt the backup?
If it sits on media that can be lost or that leaves the house, yes. But keep the key somewhere else, and that somewhere else needs a backup too. A lost key on an encrypted backup is the same as losing the files.
How often should I back up?
As often as the amount of work you are willing to redo. If losing a day of work would hurt, daily; if a week is tolerable, weekly. A number that comes out of your own habits gets followed, and one that comes out of advice usually does not.