Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →A 3-2-1 backup strategy keeps three copies of important data in total: the working copy plus two backups. Those copies use at least two different storage media or failure domains, and at least one copy is stored offsite. Where ransomware or administrator-account compromise is a concern, add a fourth copy that is offline or otherwise isolated: the 3-2-1-1 approach.
The numbers are only the framework. A workable design also matches your recovery-point objective (how much recent work you can lose), recovery-time objective (how quickly data must be usable), retention needs, security controls, budget and ability to test restores. An external drive and a cloud destination can satisfy the pattern, but only if the cloud copy preserves recoverable versions and is sufficiently independent from the primary system.
As an Amazon Associate I earn from qualifying purchases.
What the 3-2-1 rule actually requires
The original copy counts. You do not need three separate backup devices in addition to your computer or server. Count the arrangement this way:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Copy 1: the live data on your computer, phone, server or network-attached storage.
- Copy 2: a backup on a separate medium or destination, normally created automatically.
- Copy 3: another backup on a different medium or in a different failure domain.
- One offsite copy: at least one backup is physically or geographically separate from the primary location.
CISA presents the rule as protection against different kinds of failure. A second copy on the same computer, the same disk array or an account controlled by the same compromised credentials may disappear along with the original. “Different media” therefore means more than using two folders with different names.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
The 3-2-1-1 extension
The additional “1” is an offline or isolated copy. It may be a removable disk disconnected between jobs, tape stored without network access, or a backup repository with strong immutability and separate administration. Offsite and offline are different properties: a cloud repository can be offsite while remaining online, and a removable disk in the same office can be offline while still vulnerable to fire, theft or flooding.
Start with recovery objectives, not hardware
Before choosing media, write down what recovery must achieve. NIST guidance on storage protection calls for policies that define tiers, copy counts, frequency, retention and media type, while considering restoration speed and the required RPO and RTO.
Recovery-point objective (RPO)
RPO is the maximum amount of recent work you are prepared to lose. If losing a day of edits is acceptable, a daily backup may meet the objective. If losing an hour of transactions would be costly, backups need to run at least hourly or use a continuously captured, versioned system. A synchronized folder without retained history may reproduce an accidental deletion immediately, so synchronization alone does not establish an RPO.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRecovery-time objective (RTO)
RTO is the time between an outage and usable data or service. Restoring a few documents from a local disk has a very different RTO from rebuilding a server, database and identity system over a slow internet connection. NCSC notes that solid-state storage restores much faster than tape; the faster medium may be justified for the first recovery copy even when tape or another medium is retained for long-term history.
Retention and legal or business history
Retention answers how many versions and how much history to keep. Define it per data tier rather than applying one period to everything. Keep enough versions to cover accidental deletion, malware discovery delays, project milestones and any applicable business or legal requirement. Retention is useful only if the provider or device can actually recover versions throughout that period.
Dependencies
Files may be unusable without applications, database engines, configuration, identity services, encryption keys or license information. Record those dependencies for each critical workload. A successful single-file restore does not prove that a complete service can be brought back.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
A practical build process
1. Inventory the data and systems
List computers, phones, servers, virtual machines, databases, shared drives, configuration files and encryption keys. Identify where each item lives now, who owns it, how much data changes, and what would happen if it were deleted or unavailable. Include data held by a hosted service; confirm whether that service offers export and version recovery instead of assuming it is protected by the provider.
2. Group information into recovery tiers
Create a small number of tiers that people can understand and maintain. For example, a critical database may require frequent copies and rapid local recovery, while an archive of old media may tolerate slower restoration. Assign an owner and document the RPO, RTO, retention, encryption requirement and restore order for every tier.
3. Select independent media and destinations
Choose at least two media types or failure domains that do not share the same likely failure. A local external hard drive plus a separately administered offsite backup service is a common pattern. Other combinations include local disk plus removable media, local disk plus tape, or local disk plus optical media. The word “cloud” describes a service and location, not necessarily a different physical technology; evaluate its account, permissions, region, deletion behavior and provider controls.
4. Automate the copy jobs
Use scheduled backup software or platform controls so the process does not depend on memory. Configure version retention, encryption, destination selection and failure notifications. Ensure a job cannot report success after copying only a subset of the required data. For a removable local disk, schedule the job when the disk is connected and disconnect it when the run finishes, if your workflow allows.
5. Put one copy outside the primary site
Use a different building or geographic location for at least one copy. Options include a separately stored removable medium or an offsite backup service. Check how the first full backup is transferred, how later increments are sent, where the data is located, and how a large restore is delivered if the internet connection is unavailable or too slow.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
6. Add offline or isolated protection
For ransomware resistance, maintain a copy that ordinary production credentials and network paths cannot modify. Disconnect removable media between runs, use an immutable retention policy where appropriate, or place backup administration on a separate identity and network boundary. HHS OCR warned in an October 2022 newsletter that some ransomware variants can delete or disrupt online backups and advised regulated entities to consider keeping at least some backups offline and unavailable from their networks. That is a risk-control recommendation, not a universal legal requirement.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
7. Document the arrangement
Maintain a recovery catalog containing the copy location, version, retention expiry, encryption status, key owner, responsible person and restore procedure. Store a usable copy of the catalog separately from the production system. Document how to obtain credentials and keys if the primary computer, phone or password manager is lost.
8. Monitor and correct failures
Review job status rather than assuming a scheduled task ran. Alert on missed runs, authentication failures, insufficient capacity, incomplete transfers, expired retention or a disconnected destination. A strategy that silently fails for weeks is not a backup strategy.
Example layouts for common situations
Home user or small office
| Copy | Possible placement | Controls to verify |
|---|---|---|
| 1: primary | Computer, phone, NAS or local server | Normal device security and account protection |
| 2: local backup | Separate external hard drive or local backup destination | Automatic schedule, version history, encryption, and disconnection or restricted access between runs |
| 3: offsite backup | Removable media stored elsewhere or an offsite backup service | Independent credentials, documented retention, recoverable versions, encryption and a known restore path |
| Optional offline layer | Disconnected removable media or an isolated/immutable repository | Production accounts cannot delete or rewrite it |
This arrangement is a starting architecture, not a promise that every external drive and every cloud product complies automatically. Confirm how deleted files are recovered, how many versions remain, whether the provider can restore a whole system, and whether encryption keys can be recovered without the original device.
Small organization or higher-value data
- Inventory applications and data stores, including identity, configuration and key-management systems.
- Assign each workload to a recovery tier with an owner, RPO, RTO, frequency and retention.
- Separate backup administration from ordinary production administration.
- Encrypt data in transit and at rest, and protect key material independently.
- Use at least one offsite copy and an offline or isolated copy where the threat model requires it.
- Keep a recovery catalog and test application-consistent restores, including dependency order.
- Refresh media, software and compatible readers before they become unsupported.
What counts as two different storage media?
Different media should reduce correlated risk, not merely create two labels in a backup console. Consider the following options against your RPO, RTO, retention and threat model.
| Medium or destination | Strengths | Questions and limitations |
|---|---|---|
| External hard drive | High capacity, familiar operation and fast local restores | Can be stolen, encrypted by ransomware or damaged with the primary site if it stays connected or nearby; rotate and disconnect when practical |
| Solid-state drive | Fast transfers and restores, no moving parts during operation | Still vulnerable to account compromise, deletion, theft and site-wide incidents; evaluate long-term retention and refresh needs |
| Magnetic tape | Can be offline and suitable for long retention when managed correctly | Slower access, specialized hardware and software, and a need to verify readability and maintain compatible drives |
| Flash or other removable media | Portable and easy to isolate physically | Small devices are easy to lose; track encryption, integrity, rotation and replacement |
| Optical media | Can be stored offline and write-protected depending on the format | Limited capacity and slower workflows; retain compatible readers and verify media condition |
| Local disk or NAS | Automated, convenient and quick for local recovery | May share power, network, administrator credentials or location with production; add separation rather than counting a second folder |
| Hosted cloud backup | Offsite storage, automation and potentially broad version retention | Check provider isolation, account recovery, encryption and key ownership, deletion protection, geographic location, bandwidth and restore logistics |
NCSC gives magnetic tape and an external hard drive as examples of different media and notes that large transfers can overlap the next backup run. Measure whether the first full copy and subsequent changes can finish within your available window. Cost includes media, offsite storage, bandwidth, maintenance and the expense of a large restoration, not just the subscription or device.
Can an external hard drive and cloud backup satisfy 3-2-1?
They can, when the external drive is a genuine backup and the cloud destination is more than a synchronized mirror. The arrangement normally counts the computer as copy one, the external drive as copy two and the offsite cloud backup as copy three. It still needs two meaningfully different failure domains and at least one copy that survives a ransomware event or compromise of the primary account.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Before counting the cloud copy, verify:
- Version history and retention after a file is deleted or overwritten.
- Recovery of an entire computer, server or database when that is required, not just download of individual files.
- Separate administrative credentials and protection against unauthorized deletion.
- Encryption in transit and at rest, plus a documented method to recover encryption keys.
- Geographic location, outage behavior, bandwidth limits and the process for a very large restore.
- Whether synchronization propagates malicious changes immediately.
If the service only mirrors a folder, treat it as availability or collaboration storage, not as the second backup, until retained and restorable versions are demonstrated.
Protect backups from ransomware and account compromise
Encrypt data and preserve the keys
Encrypt sensitive backup data in transit and at rest. Keep encryption keys, recovery codes and key-management instructions in a protected location that is not the only backup destination. Test key recovery as part of a restore; an unreadable encrypted backup is not a usable copy.
Separate access and administration
Limit who can read, delete, change retention or alter backup jobs. Use separate backup-administrator identities instead of granting every production account permission to destroy repositories. Restrict network paths and management interfaces, and review access regularly.
Use offline, isolated or immutable controls
Offline media cannot be changed through a network attack while it is disconnected, but it must still be physically secured and checked for readability. An immutable repository can provide a similar protection against deletion during a defined retention window, provided the policy, administrator access and provider controls are genuinely separate from production.
Track the physical and logical state
Record where each medium is stored, which version it contains, when it expires, whether it is encrypted, and who can access it. Label removable media without exposing sensitive contents. Rotate media so one device is not the only copy of a particular period.
How often should backups run?
Set frequency from the RPO rather than from a generic calendar. A useful planning mapping is:
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
| If the tolerated loss is… | Design implication |
|---|---|
| Up to a day of work | At least daily versioned copies may be appropriate, subject to the data’s change rate and restore test |
| A few hours | Run several times per day or use a system that captures changes and retains versions |
| Minutes or less | Use frequent or continuous capture with an independently recoverable history, and confirm that the destination and network can keep up |
These are planning examples, not universal schedules. Large datasets, limited bandwidth or a narrow backup window may require changed-data capture, local staging or a different destination. NCSC cautions that large transfers can overlap, so observe actual completion and adjust the design.
Test restores, not just backup jobs
NIST SP 800-209 (2020) states: “Periodically test backups (at least monthly for critical data) to verify their integrity and their ability to be restored.” A green job status proves that a process ran; it does not prove that the required data, applications, keys and dependencies can be recovered within the RTO.
Use progressively harder tests
- File test: restore a deleted document to a separate location and verify it opens correctly.
- Version test: recover an earlier version after an intentional edit or deletion.
- Application test: roll back an application upgrade and verify configuration and data together.
- Database test: restore a database and run integrity checks, then confirm dependent applications can connect.
- System test: rebuild an operating system or virtual machine, including drivers, configuration and identity access.
- Scenario test: simulate loss of the primary site, a compromised administrator account or a ransomware event, then recover from the offsite or isolated copy.
For applications with strict recovery-speed requirements, NIST recommends a full sandbox restore. Related databases, application servers, identity systems and configuration may need coordinated recovery in a defined order.
Recommended Free Tools
Record evidence from every test
Log the test date, copy and version used, data owner, elapsed restoration time, integrity checks, missing dependencies, access or key problems and corrective actions. Repeat after major architecture, software, credential or retention changes. A failed test is useful when it produces a specific fix and a retest date.
Maintain media over its entire retention period
Storage media and backup software age. Before retaining a copy for years, confirm that compatible readers, drivers, formats and software will remain available. Refresh or migrate media before it becomes unreliable or unsupported. Include migration in the retention plan rather than discovering at restore time that the only reader is obsolete.
For hosted services, review contract and account-recovery assumptions periodically. Confirm that retained versions, geographic placement, encryption keys and export options still match the policy. For removable media, inspect physical condition, verify readability and keep at least one known-good reader and the necessary cables or adapters.
Common design mistakes and fixes
| Failure mode | Why it fails | Fix |
|---|---|---|
| Two copies on one device | A disk failure, theft or malware event removes both | Move a copy to a separate device and failure domain |
| Connected drive is always writable | Ransomware can encrypt or delete the backup | Disconnect between runs or enforce isolation and immutable retention |
| Cloud synchronization counted as backup | Malicious or accidental changes may be mirrored immediately | Use retained, recoverable versions and test deletion recovery |
| Offsite copy uses the same compromised account | An attacker can delete every destination with one credential | Separate administration, credentials and recovery controls |
| Only a file restore has been tested | Applications, keys and dependencies may still be missing | Run application-consistent and sandbox recovery tests |
| No record of keys or locations | The data exists but cannot be accessed after device loss | Maintain a protected recovery catalog and independent key-recovery instructions |
| Backup window is too short | Transfers overlap or never finish | Measure throughput, reduce changed data, stage locally or choose another destination |
A review checklist
- Are there three total copies, including the original?
- Do at least two copies use genuinely different media or failure domains?
- Is one copy offsite, and is another offline or isolated where the threat model requires it?
- Does each critical tier have a documented RPO, RTO, frequency and retention period?
- Are versions retained after deletion or malicious modification?
- Are data and keys encrypted, with a tested key-recovery path?
- Can production credentials delete or rewrite every backup?
- Are job failures, capacity problems and expired copies monitored?
- Have file, application and full-system restores been tested at the required interval?
- Are media, readers, software and restore instructions maintained for the full retention period?
A 3-2-1 design is successful when an actual incident can be recovered with known data loss, known elapsed time and no improvisation. The media choices can change as workloads and threats change, but the independence, security and testing requirements must remain explicit.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
