Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
I stopped worrying about losing my self-hosted data when backups became a recovery system rather than a scheduled copy job. Each service now exports its database or reaches a quiescent state before capture; encrypted repositories receive the data on a local target and an off-site target; an offline or immutable copy is disconnected after the run; and alerts tell me when a job, integrity check, or destination fails. Most importantly, I regularly restore a file, a database, and a complete service in a clean environment. That workflow follows the 3-2-1 principle and addresses the failures that a green scheduler icon cannot detect: inconsistent application files, deleted repositories, lost keys, and backups that have never been proven restorable.
What does an automated backup system for self-hosted services actually need to do?
A dependable system has four separate jobs: identify durable data, capture it consistently, keep separated copies, and demonstrate recovery. Automation handles timing, but it cannot make an unsafe snapshot safe or make one copy resilient to ransomware.
As an Amazon Associate I earn from qualifying purchases.
- Durable-state inventory: record each service’s database, uploads, configuration, secrets, certificates, compose files, and infrastructure-as-code. Treat caches, temporary files, and rebuildable container images as a separate category.
- Consistency control: create a native database dump, take a transaction-consistent snapshot, or stop/quiesce the service before the repository job reads its files.
- Separated repositories: keep a fast local copy for routine restores, an off-site copy for loss of the host or site, and an offline or immutable copy.
- Operational proof: alert on failures and missed runs, check repository integrity, and perform real restores on a schedule.
This is why choosing a backup executable is only one part of the design. The repository can be perfectly encrypted and deduplicated yet still contain an unusable database dump, or be deleted while mounted on the same machine as the production service.
How do I inventory Docker and other self-hosted services before backing them up?
Start with a service-by-service data map. For every container or host service, identify where state lives and what is needed to recreate the service on a clean machine.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Classify what must survive
- Databases: PostgreSQL, MySQL, SQLite, and other database files should normally be exported with their native dump tools or captured with a transaction-consistent snapshot.
- User content: uploads, media libraries, documents, and generated assets are usually stored in named volumes or host directories.
- Configuration: compose files, environment files, reverse-proxy configuration, scheduled jobs, and service-specific settings determine how the data is interpreted.
- Secrets and certificates: encryption keys, API credentials, TLS certificates, and recovery codes are separate recovery dependencies. Store their escrowed copies outside the host being backed up.
- Rebuildable material: container images and caches can often be pulled or regenerated. Document the image versions, but do not let their presence hide an unprotected database or secret.
Write the inventory so another person can tell which dump belongs to which service, which version of the compose definition created it, and which secrets are required to start a restored instance. An inventory that exists only in the host’s filesystem disappears with the host, so keep a copy in the backup set and another in your recovery documentation.
How do I capture active databases and volumes without corrupting them?
Do not let a repository tool read changing application files and assume the result is a usable backup. Borg’s official quick-start warns that active files may change while they are being read, producing an internally inconsistent capture.
Use a database-native export when possible
Schedule each database dump before the repository job. Validate that the dump completed, record its exit status and log, and place the resulting file in a staging location included in the next backup. A successful repository run does not prove that a failed or truncated dump is restorable.
Quiesce file-based services
If a service cannot produce a consistent export, stop it briefly or put it into a maintenance mode while its volume is captured. This is especially important for applications that update several related files, indexes, or journals together.
Use snapshots when downtime is unacceptable
A filesystem or volume snapshot can provide a stable point-in-time view while the service continues running, provided the snapshot mechanism is transaction-consistent for that workload. Document how snapshots are created and released; an untested snapshot process is not a recovery plan.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Keep the consistency operation and repository operation visibly separate in logs. If the dump step fails, the backup workflow should fail or raise an alert rather than quietly archive yesterday’s dump and report success.
Which is better for self-hosted backups: Restic or Borg?
Both are credible encrypted, deduplicating engines. Restic emphasizes a portable single executable and many storage back ends; Borg emphasizes its repository/archive model, efficient deduplication, and local or SSH-based operation.
| Decision area | Restic | BorgBackup |
|---|---|---|
| Deployment | One executable with official support for Linux, BSD, macOS, and Windows. | Mature command-line tool using local repositories or repositories reached over SSH. |
| Storage efficiency | Content-defined chunking and transfer of changed portions. | Content-defined deduplication with optional compression. |
| Security | Encrypted and authenticated repository data; integrity checks can detect modification. | Optional authenticated encryption; repository access requires the key material and passphrase. |
| Multiple hosts | A repository can serve trusted hosts. Separate repositories provide stronger isolation. | The repository/archive model supports repeated runs; deployment controls which hosts or users can reach it. |
| Automation fit | A container image is available; give the container a static hostname so repository identity does not change unexpectedly. | An official systemd/udev pattern can start a one-shot job when a registered disk is attached, log the run, and unmount or eject the disk afterward. |
| Main caveat | An administrator with delete access to the storage can still remove or manipulate repository data. | Files that are active during capture can be inconsistent unless services are quiesced or snapshotted. |
Choose based on your storage and operating model, not on a claimed speed advantage. No independent restore-time or failure-rate benchmark is established here; measure your own backup duration, restore duration, and repository growth during drills.
How do I arrange local, off-site, and offline copies?
Use the FBI’s 3-2-1 guidance as the minimum shape: at least three copies of critical data, on two different media types, with one copy offline and immutable. The UK National Cyber Security Centre gives the same principle for offline backups.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteLocal copy for ordinary mistakes
A repository on a separate disk or storage system on the local network makes accidental deletion and routine file restores fast. It does not protect against loss of the host, a failed site, or malware that can reach the repository.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Off-site copy for site failure
Send an encrypted repository to a different location or an independent storage service. Restic supports online and self-hosted storage types, while Borg can use a remote repository over SSH. Keep the off-site credentials and recovery instructions outside the production host.
Offline or immutable copy for destructive attacks
An external USB hard drive is useful when it is mounted only for the backup window and physically disconnected afterward. CISA warns that leaving the drive connected gives ransomware on the host a path to delete or corrupt it. One drive is still only one copy, so it supplements rather than replaces local and off-site repositories.
How do I automate backup runs and know when they failed?
Use a scheduler you already operate reliably—systemd timers, cron, or an orchestration tool—but make the workflow fail loudly and leave an audit trail.
Recommended Free Tools
- Prepare the source: run database dumps, snapshots, or service stop/quiesce actions. Record each result.
- Open the destination: mount the local or removable target only for the backup window. For a removable disk, an attach-triggered systemd/udev job can start the one-shot process and eject it afterward.
- Run the repository job: execute Restic or Borg under a dedicated account with only the read access needed for source data and write access to the repository.
- Check the result: treat a non-zero exit status, a missed timer, a repository-check failure, or low destination capacity as an incident requiring attention.
- Close the exposure: unmount and disconnect removable media. Do not leave a backup disk continuously writable from the production host.
- Notify a human: send alerts somewhere other than the backed-up host so a host failure cannot hide the warning.
Keep repository keys and recovery instructions outside the machine being protected. A scheduler that runs perfectly but cannot be decrypted after a host loss has not met its objective.
How should I set retention without deleting my only good restore point?
Define retention around recovery decisions rather than storage convenience. A practical policy preserves daily, weekly, and monthly points, then runs maintenance only after you have confirmed that the policy does not remove the last known-good copy.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Shared repositories improve deduplication and simplify administration, but every trusted host shares the repository’s keys and retention controls. Restic’s guidance notes that separate repositories provide stronger isolation. Use separate repositories when hosts, users, or trust boundaries differ, even if that consumes more storage.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Review retention after a restore exercise. If the oldest point you need is already being pruned, change the policy before the next incident; do not assume a larger repository automatically means a longer usable history.
How do I protect encrypted backups from ransomware and operator mistakes?
Encryption protects confidentiality and helps detect modification, but it does not make deletion impossible. Restic explicitly notes that an attacker with write access to the storage location can delete or manipulate repository data.
- Use separate credentials for production, local backup storage, and off-site storage.
- Limit the backup account to source read access and repository write access; do not grant it unrestricted shell or administrator privileges.
- Keep an escrowed repository key or passphrase in a separate secure location. Without it, an encrypted repository cannot be recovered.
- Mount removable media only during the backup window, then unmount and disconnect it.
- Use an immutable destination where your storage platform supports that control, and verify the retention lock behavior before relying on it.
- Monitor capacity and unusual deletion or modification activity; a repository that suddenly shrinks deserves investigation.
These controls address different threats. Encryption limits disclosure, isolation limits unauthorized use, and offline or immutable copies limit destructive access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I prove that a backup can actually be restored?
A completed restore is the confidence-producing event. NIST SP 1339, published June 17, 2026, describes effective backup management as creating backups regularly, testing them, and reviewing them during recovery exercises. FBI and CISA guidance likewise calls for testing availability and integrity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Start small: restore a recently changed file to a temporary directory and verify its contents and permissions.
- Restore a database dump: use a clean, isolated database instance, import the dump, and run an application-level check rather than stopping at a successful import message.
- Rebuild one complete service: provision a clean environment, retrieve the compose or infrastructure definition, restore configuration and secrets from their documented locations, and attach the restored data.
- Exercise the off-site path: perform the same process using the remote repository, not only the fast local copy.
- Measure and record: note restore duration, data volume, missing configuration, failed permissions, and the person who performed the recovery.
- Feed corrections back: update the inventory, automation, and retention policy whenever the drill exposes a gap.
Do not invent a universal recovery-time target. Your own drills provide the relevant measurements for your hardware, network, encryption, and service dependencies.
What commonly fails, and how do I fix it?
| Symptom | Likely cause | Corrective action |
|---|---|---|
| Repository job is green but the application will not start | Active files were captured in an inconsistent state, or a database dump failed before capture. | Quiesce the service, use a native dump or consistent snapshot, validate the dump, and repeat a clean restore. |
| All copies disappear after an incident | Local and removable repositories were mounted and writable from the compromised host. | Add an off-site repository and an offline or immutable copy; disconnect removable media after each run. |
| Repository cannot be opened during recovery | The key or passphrase was stored only on the failed host. | Escrow recovery material in a separate secure location and test retrieving it during a drill. |
| Retention removed the point you needed | Pruning was designed around storage limits rather than recovery requirements. | Preserve daily, weekly, and monthly points and review pruning against a known-good restore. |
| One host can affect every repository | All hosts share one repository, key, or administrative account. | Separate repositories and credentials at trust boundaries, accepting the additional storage cost. |
| Missed runs go unnoticed | Scheduling exists without monitoring or external notification. | Alert on missed timers, non-zero exits, failed checks, and destination-capacity warnings. |
What should my recurring backup runbook contain?
Your runbook should be short enough to follow under pressure and complete enough that someone else can perform it. Include the service inventory, the order of database dumps and quiesce actions, repository locations, mount and unmount procedures, key-escrow location, retention policy, alert destinations, and clean-environment restore steps.
After every material change—new service, database migration, storage move, or credential rotation—run a small restore and update the documentation. Integrate backup review into change management so the backup system evolves with the services it protects.
Frequently Asked Questions
Should I back up container images as well as volumes?
Track the image names and versions needed to rebuild a service, but prioritize databases, uploads, configuration, secrets, certificates, and infrastructure definitions. Images and caches are usually reproducible; undocumented version pins and missing secrets are what commonly prevent a clean rebuild.
What happens if I forget the Restic or Borg passphrase?
The encrypted repository is not recoverable without its key material or passphrase. Keep an escrowed copy in a separate secure location and include retrieval of that escrow in a recovery exercise, rather than discovering the dependency during an outage.
Can I use one repository for several trusted servers?
Yes, a shared Restic repository can simplify deduplication and administration. Separate repositories are safer when servers or operators have different trust boundaries because keys and retention controls are otherwise shared.
How do I decide whether a restore drill was successful?
Define success as a working service, not merely a repository command that exits cleanly. The restored application should read its database, serve representative user data, use the required secrets and certificates, and have its elapsed recovery time and missing dependencies recorded.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
