Use a 3-2-1 backup design with one encrypted copy isolated from ordinary network access, separate backup credentials and keys, and regularly tested restores. Cloud synchronization and a construction platform’s internal replication can improve availability, but neither should be treated as your only ransomware-safe backup. The practical goal is to ensure that an attacker who compromises a workstation or domain account cannot encrypt or delete every usable copy of drawings, models, schedules, submittals, photos and project records.
What a ransomware-resistant backup must do
Ransomware resilience is not the same as having more copies. If every copy is reachable through the same compromised account, mapped drive or synchronization process, one attack can damage them all. A usable design separates copies by location, technology, credentials and, for at least one copy, network reachability.
As an Amazon Associate I earn from qualifying purchases.
The most useful baseline is the 3-2-1 arrangement: keep at least three copies of important data, use two different media types, and keep one copy off-site. For ransomware, add a stronger requirement to that baseline: at least one copy must be offline or otherwise isolated so ordinary workstation and domain credentials cannot readily alter or delete it. Encrypt the backup and protect its recovery keys separately.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsNo backup arrangement can promise that a firm will never lose data. It can, however, prevent a single compromised environment from destroying every recovery option. CISA’s September 2023 #StopRansomware Guide emphasizes offline, encrypted backups and regular recovery testing. Those controls matter more than the brand of storage or the number of backup jobs shown as successful.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Why synchronization is not an independent backup
Synchronization is designed to make the same files available in multiple places, not to create an isolated recovery copy. CISA warns that ransomware-encrypted local files may synchronize to cloud storage and overwrite previously healthy data. A second computer displaying the same encrypted files is therefore not a second recovery point.
Version history can provide a way back to an earlier file, but only if the service retains the needed versions, prevents an attacker from deleting them and allows the firm to restore or export them. Check those controls rather than assuming that “cloud” means immutable. A synchronization service may also replicate accidental deletions, corrupted models or a malicious mass rename.
Keep synchronization for collaboration and availability, then create a separate backup path with its own retention, access controls and recovery procedure. Confirm how long historical versions remain available and whether administrators can shorten or remove that period.
Inventory every place project information exists
Before choosing storage, make a written inventory. Construction information is usually distributed across shared folders, individual workstations, file servers and one or more construction cloud platforms. Missing one location can make an otherwise healthy backup incomplete.
Include project content and the data around it
- Drawings, specifications and contract documents.
- Revit or other design models, linked files and model coordination data.
- Schedules, estimates, cost data, change orders and payment records.
- Submittals, RFIs, transmittals, meeting minutes and correspondence that must be retained.
- Site photographs, inspection records, videos, scans and field reports.
- Shared project folders, local working directories and file-server shares.
- Cloud-hosted project files, version history and exportable metadata.
- Templates, scripts, permissions information and configuration needed to resume work.
This construction-specific list applies CISA’s instruction to identify critical data and systems; it is not a CISA-prescribed inventory. Record the owner of each data set, its current location, its format and the method used to restore it.
Rank #2
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Set loss and downtime limits before setting a schedule
Decide how much recent work the firm can afford to lose and how long each function can be unavailable. These are business requirements, often described as the recovery point objective (RPO) and recovery time objective (RTO). A project nearing a contractual submission may need a tighter RPO than an archived project, while a field-photo archive may have a different priority from a live coordination model.
The sources do not prescribe one construction-specific backup frequency. Use the agreed RPO to choose the schedule, then verify that the schedule actually produces recoverable versions. A frequent job that copies encrypted files is not safer than a less frequent job whose clean copy is isolated and tested.
Build the backup architecture
Use 3-2-1 as a starting point, not the finish line
| Layer | Purpose | Ransomware consideration |
|---|---|---|
| Primary working copy | Daily project work in approved folders or platforms | Assume it can be encrypted or deleted during an account compromise. |
| Operational backup | Fast backup for recent files and ordinary recovery requests | Use separate backup permissions; do not expose it through every user’s mapped drives. |
| Isolated or offline backup | Recovery copy outside routine attacker reach | Disconnect removable media between jobs, or use carefully configured isolation or immutability. |
| Different media and off-site location | Protection from a single device, site or incident | Keep at least one copy away from the production environment and account boundary. |
The traditional 3-2-1 wording refers to three copies, two media types and one off-site copy. For modern cloud environments, also ask whether a compromised administrator can reach the off-site copy, change retention or delete its versions. Geographic separation alone does not provide credential separation.
Keep one copy inaccessible during ordinary work
A portable external hard drive or SSD can serve as one physical layer when it is connected only for the backup operation and then disconnected. CISA specifically advises not leaving an external drive connected when it is not actively being used for backup. Store it securely, label the coverage period, and rotate more than one drive if the firm needs a recent and an older recovery point.
Isolation can also be implemented with a backup repository that is not joined to the ordinary user network, a separate administrative account or immutable storage. “Immutable” is not a magic word: CISA notes that immutable storage must be configured carefully, may create significant costs if misconfigured and may not satisfy every regulatory requirement. Verify who can change retention, how emergency recovery works and whether the setting applies to all relevant data.
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Encrypt data and separate the keys
Encrypt backup data at rest and during transfer, then control the encryption recovery keys independently of everyday project accounts. If ransomware compromises the same credentials that unlock the backup and its keys, encryption does not provide much practical protection. Give authorized recovery staff a documented way to obtain the keys during an incident, while preventing ordinary workstation users from accessing or deleting them.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteKeep more than one authorized person able to recover the keys, but avoid placing them in the same encrypted file shares that the backup is meant to protect. Record the key owner, access process and last verification date.
Handle construction cloud platforms deliberately
Separate platform replication from your own backup plan
Construction platforms may replicate customer data between storage locations for business continuity. Autodesk’s regional offerings FAQ states that its data replication is part of that strategy but also says the strategy “cannot and does not replace your business continuity strategy or data backup and recovery plans.” Treat provider replication as a platform availability feature, not as proof that your firm has an independently controlled ransomware recovery copy.
Regional offerings can use different corresponding backup regions. Firms with data-residency, contractual or regulatory obligations should confirm the current configuration and responsibilities for their region instead of assuming where replicas are stored.
Use version history, exports and retention consciously
Platform-specific recovery tools remain valuable. Autodesk training covers setting recovery standards, finding cloud version history, backing up cloud files and recovering Revit cloud workshared models. Use those procedures where they fit your projects, but pair them with an independent copy aligned to your threat model.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
- Identify which cloud data can be exported and in what format.
- Confirm whether linked files, permissions, comments and metadata are included in an export.
- Document the retention period for earlier versions and who can change it.
- Test restoring both an individual file and a complete project or model set.
- Record what the platform provider manages and what your firm must back up itself.
Do not claim that any platform is ransomware-proof, that a particular retention window applies everywhere or that restoration is guaranteed unless current product documentation confirms those facts for the relevant region and subscription.
Implement the plan step by step
- Assign ownership. Name a business owner for project data, a technical owner for backup operations and at least one alternate who can perform recovery. Include project management and field operations in decisions about priorities.
- Map sources and dependencies. Match every inventory item to its source system, backup method, retention rule and restoration format. Note linked models, databases, templates and credentials that must be available for a usable restore.
- Set RPOs, RTOs and priorities. Write down acceptable data loss and downtime for active projects, shared services and archives. The result determines schedules and recovery order; there is no universal construction frequency supplied by the guidance.
- Create the routine backup. Back up project folders, servers and supported cloud data on the schedule required by the RPO. Monitor failures, unusual volume changes and jobs that complete without including expected sources.
- Create an independently protected copy. Send a second copy to disconnected media, an isolated repository or correctly configured immutable storage. Use backup credentials that ordinary workstation and domain accounts cannot use to delete or alter the copy.
- Encrypt and protect keys. Enable encryption, document the recovery-key process and verify that authorized staff can retrieve keys without relying on the compromised production environment.
- Disconnect removable media. After an external drive finishes its backup, eject it and disconnect it. Keep it in a controlled location and rotate media if the firm needs multiple historical points.
- Verify coverage. Check that drawings, models, schedules, submittals, photos, records and required configuration are present. A green status indicator is not evidence that every required file was captured.
- Run a restore exercise. Restore representative files and at least one project-level set to a clean location. Open models, drawings and office documents, check dates and links, and record the elapsed time and access needed.
- Document and improve. Record the test result, failures, corrective actions, retention settings, key custodians and next test date. Update the plan when a project platform, contract, region or file workflow changes.
Compare approaches using the risks that matter
| Approach | Isolation | Versioning or immutability | Coverage and recovery questions | Main trade-off |
|---|---|---|---|---|
| Synchronization alone | Usually low; compromised accounts may reach both locations | Depends on provider history and deletion controls | Can the firm recover a clean version after encrypted files synchronize? Can it export all project data? | Convenient collaboration, but not an independent ransomware backup. |
| Connected operational backup | Better than sync only if backup credentials and shares are separate | Depends on retention and administrative controls | Can an attacker delete the repository? Has a full project restore been tested? | Fast recovery, but still exposed if the repository shares the production trust boundary. |
| Disconnected external drive | High while physically disconnected | Versions depend on rotation and labeling | Can the firm find the right drive, decrypt it and open representative files? | Low complexity, but requires handling, rotation, secure storage and manual testing. |
| Isolated or immutable repository | Potentially high when network and credentials are separated | Can protect retention from alteration when configured correctly | Who can release data, how are keys handled and what does a full restore cost in time? | More administration and possible cost or compliance concerns; misconfiguration can defeat the design. |
| Construction-platform replication | Managed by the provider’s architecture, not solely by the firm | Replication is not necessarily customer-controlled versioned backup | What is replicated, where, for how long and how does the customer recover? | Supports business continuity but does not replace the firm’s own plan. |
For each approach, answer five questions: Can a compromised credential delete it? Can the firm recover an earlier clean version? Does it cover cloud-hosted and supporting data? Has restoration been exercised? Are location, keys, retention, cost and compliance responsibilities understood?
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test restoration, not just backup completion
A backup job reporting success proves only that a process ran. CISA calls for regular testing of backup availability, integrity and procedures. A construction test should use files that expose real dependencies rather than a single small text document.
Use representative test data
- Open a large drawing and confirm that it is readable and not truncated.
- Open a representative design model and verify linked files or required references.
- Restore a schedule, submittal package, field-photo set and project record.
- Test both a single-file recovery and a project-level recovery from the isolated copy.
- Measure how long it takes to locate the copy, obtain keys, restore data and provide access to staff.
Restore into a clean environment
Do not restore into systems that may still be compromised. CISA recommends restoring from offline, encrypted backups according to critical-service priorities and avoiding reinfection during recovery. Use a clean destination, verify that security controls are active, and reconnect recovered data only after the environment and accounts have been checked.
Free tools Windows power users keep installed
One-click scans. No signup required.
Record evidence of recoverability
For every exercise, record the source copy, retention point, files tested, integrity checks, people involved, permissions required, elapsed time and failures. Correct missing data, broken links, inaccessible keys or inadequate permissions before the next incident. Repeat tests on a regular schedule and after major platform or workflow changes.
Best Value
- USB-C and USB 3.1 compatible.Specific uses: Business, personal
- Innovative style with refined metal cover
- Password protection with 256-bit AES hardware encryption
- Formatted for Mac
Recovery priorities when ransomware strikes
Recovery should follow the incident plan rather than whoever asks first. Identify the affected systems, stop mechanisms that could continue propagating encrypted files, and keep potentially compromised environments separate from clean recovery systems. Preserve the isolated backup and its keys while the incident is assessed.
- Protect the recovery source. Do not connect offline media to an infected workstation. Use a clean, controlled system for inspection and restoration.
- Restore critical services first. Use the priorities established in the RPO and RTO exercise. A firm may need identity, file access or project coordination services before restoring lower-priority archives.
- Restore a small representative set. Confirm that files are clean, complete and usable before expanding the recovery.
- Rebuild access carefully. Use clean credentials and restore permissions deliberately instead of copying potentially compromised account settings.
- Expand by project priority. Restore active projects and contractual deliverables according to the documented order, then handle less time-sensitive records.
- Keep monitoring after recovery. Watch for renewed encryption or suspicious changes before returning restored data to normal collaboration workflows.
Common failure modes and fixes
Every copy is mounted on the same network
Symptom: The backup repository, file server and user shares are all reachable with ordinary domain credentials. Fix: Move at least one copy behind physical disconnection, separate credentials or a carefully configured isolated or immutable system.
The backup includes encrypted files
Symptom: Jobs succeed, but recent versions are unreadable or have suspicious extensions and mass changes. Fix: Add monitoring for abnormal change volumes, preserve older retention points and test clean historical versions before overwriting them.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Cloud history exists but cannot be used
Symptom: The team cannot identify retention settings, lacks export rights or has never restored a complete model. Fix: Document the platform procedure, test file and project recovery, and add an independent backup for data the platform cannot export or retain as required.
The isolated copy is unusable
Symptom: No one knows where the drive is, the encryption key is unavailable or the media has failed. Fix: Rotate media, maintain secure key custody, inventory each copy and perform scheduled restoration tests.
Immutable storage creates unexpected cost or compliance problems
Symptom: Retention cannot be changed when required, storage grows beyond budget or the configuration conflicts with a legal obligation. Fix: Review retention, legal holds, deletion rules and cost before deployment; test emergency recovery and obtain approval from the responsible compliance and business owners.
Maintain the plan as projects change
Construction data moves as teams adopt new cloud modules, add subcontractors, close projects and change file-server layouts. Review the inventory whenever a platform or workflow changes. Remove no backup source until its replacement has been tested and retained according to the firm’s obligations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
At each review, confirm:
- All active project locations are still included.
- At least one current copy remains isolated from ordinary network access.
- Backup and administrative credentials are separate from everyday accounts.
- Encryption keys can be retrieved by authorized recovery staff.
- Retention and version history cover the firm’s contractual and legal needs.
- Recent restore tests succeeded for both individual files and a project-level recovery.
- Recovery priorities and responsibilities match current projects and staffing.
The result is a layered recovery capability: synchronization helps people work, platform replication supports provider continuity, routine backups speed normal recovery, and an encrypted isolated copy protects the firm when ransomware reaches the production environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
