Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
FREEDOM251

Freedom251 › Blog › 3-2-1 backup

One SSD Backup Isn’t Enough: Build a 3-2-1-1 Recovery Plan That Survives Ransomware

By Freedom251 Team · · 11 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

No. An SSD backup gives you one additional copy, but it remains a single point of failure. Theft, fire, flood, accidental deletion, corruption, hardware failure, or ransomware can remove both your computer and the SSD. The missing half is a recovery design: keep multiple copies on different media, store at least one copy elsewhere, isolate at least one copy from routine network access, and regularly prove that restoration works.

The practical upgrade is a 3-2-1-1 plan. Keep three copies of important data, on two media types, with one copy offsite and one copy offline or otherwise isolated. Your existing SSD can remain the fast local copy; add a disconnected second medium, an offsite versioned copy, and scheduled restore drills.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Is one SSD backup enough?

One SSD backup is better than no backup, but it is not a resilient strategy. If the computer and SSD sit in the same room, one burglary, fire, flood, power event, or malware incident can destroy both. If the SSD stays plugged in, ransomware running on the computer may be able to encrypt or delete it.

The Canadian Centre for Cyber Security defines the 3-2-1 rule as three copies of important information, two different media types, and one copy kept offsite. New Zealand’s National Cyber Security Centre extends that to 3-2-1-1 by adding one offline or isolated copy for ransomware resistance. These are design targets, not guarantees that any particular device or service cannot fail.

#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
  • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
  • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
  • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
  • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
  • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.

Think in terms of recovery paths rather than devices. A local SSD can provide a fast restore after a mistaken edit. An unplugged drive can survive a ransomware incident that reaches connected storage. An offsite copy can survive a fire or theft at home. Version history can recover an earlier state after corruption or accidental deletion. No single layer covers all of those events.

What does the 3-2-1-1 backup rule require?

The rule is a checklist for independence between copies. Each number addresses a different failure mode.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Three copies

Count the live data on your computer plus two recoverable backups. A second copy on the same SSD does not count as a separate copy if it can be destroyed or encrypted in the same incident. Keep copies independently readable and make sure the backup software records successful jobs.

Two media types

Use at least two storage categories, such as an SSD and an external hard drive, or local storage and a cloud backup repository. Different media reduce the chance that one device defect, interface problem, or software error affects every copy. Capacity, price, and endurance vary by model and provider; there is no universal SSD or hard-drive lifespan that can be applied safely.

One offsite copy

Store one copy in another physical location or with a cloud service. A second drive in the same desk drawer is not offsite. The offsite layer matters for events that affect an entire building, including fire, flood, theft, and some electrical incidents.

One offline or isolated copy

Disconnect a drive after the backup completes, or use a repository with controls that prevent ordinary accounts and malware from rewriting or deleting historical versions. New Zealand guidance describes this additional “1” as offline; logical isolation can provide a similar barrier when physical disconnection is impractical.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Sale
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter | USB C Dongle with 90W Max Power Delivery, 3×5Gbps USB A Data Ports, for MacBook, Dell, and More (Charger Not Included)
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.

How should I use my existing SSD?

Keep the SSD as the convenient local recovery layer, but change how it is managed. Enable versioned snapshots or retained historical versions if your backup program supports them, rather than maintaining only a mirror of the current files.

  1. Inventory what matters. List documents, photos, project folders, email archives, browser profiles, application data, and configuration files. Record where each category lives so a backup job does not silently omit it.
  2. Choose a schedule. Run automatic backups often enough to match how much work you can afford to lose. A daily schedule suits many personal computers; active projects may need more frequent snapshots.
  3. Turn on retention. Keep multiple restore points so an encrypted or corrupted file does not immediately replace the only good version.
  4. Encrypt the SSD. Use the backup software’s encryption or full-disk encryption, and store the recovery key separately from the drive. Encryption protects confidentiality if the device is lost; it does not protect against ransomware while the drive is mounted.
  5. Disconnect after the job. Eject the SSD and unplug its cable when the backup finishes. CISA warns that leaving an external drive connected can let ransomware access, delete, or corrupt backups.
  6. Label and record it. Mark the drive with its role and the date of the last successful job. Keep a written note of the backup format and software needed to read it.

What second medium should I add?

An external hard drive is a practical second local medium because it is separate from the SSD and can be disconnected after each run. Its exact capacity, speed, price, and failure behavior depend on the model, so select enough space for your retained versions rather than relying on a generic endurance promise.

Use a rotation if you can afford two drives. Connect one for a backup, disconnect it, and keep the other away from the computer or in another location. Rotating drives limits the chance that a newly connected device is exposed to an attack that began before the backup was noticed.

Do not treat a second partition, a folder copied onto the same SSD, or two drive letters from one enclosure as two independent media types. They share hardware and often share the same failure path.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How do local SSD, external HDD, and cloud copies compare?

Each medium solves a different problem. The resilient plan combines their strengths instead of declaring one universally best.

Recovery factor Local SSD External hard drive Cloud repository
Ransomware resistance Low while mounted; better when unplugged Good when disconnected after each backup Depends on immutable versions, deletion protection, account controls, and provider design
Offsite protection Not stated; same-location storage is not offsite Not stated; becomes offsite only when stored elsewhere Designed to be offsite, but the account and provider remain dependencies
Restore speed Usually suited to fast local restores; exact speed is model and interface dependent Usually slower than an SSD; exact speed is model and interface dependent Depends on internet bandwidth, service limits, and the amount of data
Capacity and cost Not stated; varies by model and retained versions Not stated; varies by model and retained versions Not stated; varies by provider, storage volume, and retention
Version and deletion recovery Available only if the backup software retains versions Available only if the backup software retains versions Requires version history, deletion recovery, or an equivalent feature
Portability High, subject to encryption and physical protection Moderate; larger and more vulnerable to shock while operating Accessible from authorized devices, subject to account availability
Isolation options Unplug after backup Unplug after backup or store in a separate location Use separate credentials, multifactor authentication, restricted access, and immutable or locked retention where offered

How do I create an offsite, versioned copy?

Use either a drive physically kept at another trusted location or a cloud service that offers historical versions and recovery from deletion. The important property is independent recovery, not the marketing label “sync” or “backup.”

Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter | 85W Max PD, 2 USB 3.0 & 1 USBC Data Ports, SD/TF Card Reader, for Laptops/Mac and Other Type C Devices (Charger Not Included)
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.

Option 1: Rotate a drive to another location

  1. Prepare two encrypted external drives with enough space for the full backup set and retained versions.
  2. Run a complete backup to drive A, verify a sample restore, then eject it.
  3. Move drive A to a separate location such as a secure workplace or a trusted relative’s home.
  4. Bring drive B to the computer for the next cycle, back it up, verify it, and rotate it.
  5. Keep an inventory showing which drive is where and the date of its last successful backup.

Physical rotation gives you clear isolation, but it requires discipline and a safe way to protect the drive in transit and storage. Keep encryption keys available to you but not in the same case as the only copy of the drive.

Option 2: Use a cloud repository with recovery controls

Before uploading, confirm that the service supports version history, recovery from deletion, and strong account protection. Where available, enable object lock, retention lock, or another control that prevents an ordinary account from erasing historical data. Use multifactor authentication and a separate administrator identity, and save emergency recovery codes offline.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Cloud storage does not automatically solve ransomware. CISA and the Internet Crime Complaint Center warn that automated cloud backups can sync encrypted local files and overwrite unaffected data. A cloud layer is safer when it preserves immutable or independently recoverable versions and is paired with a disconnected copy.

Why isn’t cloud sync the same as backup?

Synchronization is designed to make multiple locations match. If an attacker encrypts a local folder, the sync client may faithfully upload the encrypted files and propagate the damage. A backup retains prior states and offers a way to retrieve a clean version after the current state is wrong.

Check the service’s behavior for three events: a file overwritten with bad content, a file deleted locally, and an account whose credentials are stolen. Find out how long versions remain, whether deleted items can be recovered, whether an administrator can shorten retention, and whether a separate account can restore data. Test those controls with a disposable folder before trusting the service with irreplaceable files.

How often should I test that a backup restores?

A successful backup job only proves that data was copied; it does not prove that you can read the data, find the required version, or rebuild a working system. NIST recommends periodic testing and calls for at least monthly testing for critical data. New Zealand guidance suggests restoring one file at least once a quarter and performing a full restoration at least once a year.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray | Data transfer & Fast charging for MacBook, iPhone 17/16/15, iPad, Samsung Galaxy, Apple Watch
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
  1. Quarterly file test: Choose a file from each important category, restore it to a temporary folder, open it in the appropriate application, and compare its contents with the expected version.
  2. Monthly critical-data test: For business or safety-critical information, perform a documented restore at least monthly. Include permissions, databases, and application dependencies where relevant.
  3. Annual full test: Restore to a spare computer or a clean virtual machine. Confirm that you can install the backup software, provide the encryption key, locate the catalog, and recover the required folders.
  4. Record the result: Note the date, backup set, files restored, elapsed time, errors, and corrective action. A failed test is a repair task, not a reason to hide the result.

Practice the worst case as well as the easy case. Attempt recovery when the primary computer is unavailable, when the normal account is locked, and when the latest snapshot is corrupt. Keep installers, license details, encryption keys, and written recovery steps where you can reach them without the failed computer.

How do I protect backup access and credentials?

Separate backup access from everyday computer access. Use a dedicated backup account where the platform supports it, grant only the permissions needed to write or restore, and require multifactor authentication for administrative actions. Do not save the only recovery password in a password manager that is stored solely on the computer being protected.

Encrypt data at rest on portable drives and in the cloud when supported. Store recovery keys in two protected locations, such as a printed copy in a secure place and an encrypted digital copy held separately. Restrict who can delete versions, and review account activity for unexpected logins or retention changes.

Backups help you recover availability; they do not prevent an attacker from stealing data before encryption. Use normal security controls—patching, phishing-resistant authentication where available, least privilege, and network protection—to reduce the chance of exfiltration.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What should a recovery runbook contain?

Write the procedure before an incident, when you still have time to check every dependency. Keep one copy with your offline media and another in the offsite location.

  • A list of protected computers, folders, and applications.
  • The backup schedule, retention policy, and location of each copy.
  • Instructions for connecting and safely ejecting each drive.
  • Software installers and the versions needed to read the backup format.
  • Encryption keys, account recovery codes, and the person authorized to use them.
  • The order for restoring the operating system, applications, user profiles, and data.
  • Contact details for the cloud provider or storage custodian.
  • The date and result of the last successful restore test.

Update the runbook whenever you change computers, backup software, credentials, or storage locations. A technically perfect backup can still fail if nobody knows which key unlocks it or which version contains the clean files.

Best Value
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
  • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
  • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
  • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
  • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
  • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.

What can go wrong, and what is the fix?

The SSD is always connected

Symptom: ransomware encrypts both the computer and the attached SSD. Fix: schedule the job, eject the drive, and keep an additional offline or isolated copy.

The cloud copy contains only encrypted files

Symptom: synchronization propagated the attacker’s changes. Fix: use version history or immutable retention, stop synchronization during an incident, and restore an earlier clean version.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A drive was stolen

Symptom: an offsite copy exists but its contents are exposed. Fix: encrypt portable media, protect keys separately, and document who is allowed to access the data.

The backup job reports success but a restore fails

Symptom: the catalog is unreadable, a key is missing, or files are incomplete. Fix: investigate the failed test immediately, repair the job, and create a fresh independent copy before deleting older versions.

A disaster destroys the whole building

Symptom: all local devices are unavailable. Fix: retrieve the physically offsite or cloud copy, obtain the runbook and keys, rebuild on a clean system, and verify restored files before resuming normal work.

How can I check that my plan is complete?

  • There are three recoverable copies, including the live data.
  • At least two different media types are used.
  • One copy is physically offsite or held by an independent cloud service.
  • One copy is offline or logically isolated from routine accounts.
  • Historical versions and deletion recovery are enabled where needed.
  • Backup credentials and multifactor recovery methods are separate from the primary computer.
  • Encryption keys, installers, and runbook instructions are available during an outage.
  • A single-file restore has passed within the last quarter.
  • A full restoration has passed within the last year, or monthly testing is used for critical data.

Frequently Asked Questions

Can I use two SSDs instead of an SSD and a hard drive?

Yes, two SSDs can satisfy the two-media goal only if they are genuinely independent and managed separately. Keep one disconnected or offsite, and verify that both use different cables, enclosures, or locations so one hardware fault does not remove both copies.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Should I keep a backup drive in a fireproof safe?

A safe can reduce exposure to heat and theft, but its rating may not protect every type of storage device or every duration of a fire. Treat the safe as one layer and retain a separate offsite copy rather than assuming it makes local storage disaster-proof.

What do I do first if ransomware is suspected?

Disconnect affected computers and mounted backup drives from networks and power as appropriate, but do not erase evidence before you understand the incident. Use a known-clean device to contact your security team or an incident-response provider, then restore only from versions verified to predate the attack.

How much historical backup data should I retain?

There is no universal retention number. Base it on how long corruption or unauthorized changes could remain unnoticed, legal or business requirements, and the storage available; periodically confirm that the oldest retained versions can still be restored.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

3-2-1 backupBackup strategycloud backupData Recoveryransomware protectionSSD backup

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.