Most people do not think about backups until a phone is lost, a laptop dies or a ransomware message appears. By then it is too late to start. This guide explains the 3-2-1 rule in plain language and gives you a three-session setup plan that a non-technical reader can finish in about an hour, plus a 15-minute monthly restore test.
What is the 3-2-1 backup rule?
The rule is a simple way to make sure no single accident can wipe out your data:
- 3 copies: the original file plus two backups.
- 2 types of storage: for example, internal storage on your phone or computer and an external hard drive, so that one kind of failure does not take out everything.
- 1 copy offsite: stored in a different physical location, usually a cloud service, so a fire, flood or theft at home cannot destroy every copy.
The rule is widely credited to photographer Peter Krogh, who described it in his digital asset management work for photographers in the mid-2000s, and it has since been adopted by IT professionals and cited in cybersecurity guidance. It has lasted because it covers three different ways data is lost: hardware failure, losing a whole location, and human error.
Why isn’t “my photos are in the cloud” enough?
Because syncing is not the same as backing up. Photo and file sync services mirror what is on your device. If you delete a photo or a file gets corrupted or encrypted by ransomware, the change can spread to the cloud copy. Many services keep deleted items in a recycle bin for a limited time, but that is a safety net, not a backup. A real backup keeps a separate copy that does not instantly change when the original does.
A single cloud account is also a single point of failure: one hacked, locked or full account can put every cloud copy at risk. That is why the rule asks for different types of storage and not just more copies in the same place.
Common belief |
Reality |
|---|---|
“My phone syncs to the cloud, so I’m backed up.” |
Sync mirrors deletions and damage. You need a separate backup copy. |
“I have an external drive plugged in all the time.” |
If it sits next to your computer, fire, theft or ransomware can reach it too. Keep it disconnected when not in use. |
“I made a backup last year.” |
Backups need to be regular and tested, or they may be missing recent files or not work at all. |
“Three copies in the same account is 3-2-1.” |
Three copies behind one login is closer to one copy with extra steps. |
Author’s note: [PLACEHOLDER: add 2–3 sentences from your own experience, for example a time you or someone you know lost photos or files, what saved (or didn’t save) them, or what you found during your first restore test. First-hand detail is the strongest trust signal on this page.]
What does 3-2-1 look like for a phone, photos and documents?
Here is a practical setup for a typical person with a smartphone and a laptop or desktop:
Copy |
Where |
Storage type |
Location |
|---|---|---|---|
Copy 1 (original) |
Phone and computer |
Internal storage |
With you |
Copy 2 (local backup) |
External hard drive or SSD |
Different media |
At home, disconnected when idle |
Copy 3 (offsite backup) |
Cloud backup service |
Cloud |
Away from home |
How do you set up 3-2-1 in three sessions?
This is the 3-Session Setup Plan. Do one session per sitting if you prefer, and do the monthly test (Session 3) forever.
Session 1 (15 minutes): Map what matters
- List your irreplaceable items: family photos and videos, ID and legal documents, tax and financial records, work files, contacts, and anything you could not recreate.
- Find where each lives today: phone only, laptop only, email, a messaging app, or already in a cloud account.
- Give each a priority: Irreplaceable (photos, key documents), Important (work and school files), Replaceable (downloads, apps). Focus first on the irreplaceable group.
- Estimate your size. Check how much storage your photos and files use (in your phone’s storage settings and your computer’s folder properties). This tells you what size of drive and cloud plan you need.
Session 2 (45 minutes): Build the three copies
Step A: Turn on your phone’s cloud backup (offsite copy)
- iPhone: Apple says iCloud gives you 5 GB of free storage, shared by iCloud Backup, app data, documents and iCloud Mail, and that iCloud Backup runs automatically when the device is on Wi-Fi, locked and charging. Check Settings > [your name] > iCloud, review what is included and how much space the next backup needs, and upgrade the plan if 5 GB is not enough.
- Android: Google Backup (in Settings > Accounts and backup or System > Backup, depending on the phone) saves things like device settings, call history, SMS and some app data to your Google account’s free 15 GB, which is shared with Gmail, Drive and Photos. Reports in July 2026 said that the data types in Android’s backup settings now count against that 15 GB, so check your storage page and the backup toggles.
- Also turn on photo backup (iCloud Photos or Google Photos) so your pictures are in the cloud. Remember this is the first protection, not the whole plan.
Step B: Copy photos and files to an external drive (local backup)
- Buy an external drive larger than the total size of your files (a common rule of thumb is at least twice as large, to leave room for history). Either a portable SSD or hard drive works.
- On a Mac, use Time Machine. On Windows, use the built-in Windows Backup or File History. Both can back up automatically when the drive is connected.
- Copy your phone’s photos to the computer as well (via cable or the photo app), so the drive holds them too.
- Consider encrypting the drive and keep the password or recovery key somewhere safe, but not only on the same computer.
Step C: Back up the computer to the cloud (second place for documents)
- Choose a cloud backup or storage service you trust and enable it for your Documents, Desktop and Pictures folders.
- Protect that account with a strong, unique password and two-factor authentication. If this account is lost, so is your offsite copy.
Step D: Keep one copy apart
Disconnect the external drive after backups complete. For extra protection, keep a second drive in a different place, such as a relative’s home or a safe deposit box, and update it every few months. This turns your backup into the 3-2-1-1 variant, with one copy that malware cannot reach.
Session 3 (15 minutes, monthly): The Restore Test
This is the step almost everyone skips, and the one that proves your backups work. Put a recurring reminder in your calendar (for example, the first Sunday of every month).
# |
Check |
Pass if… |
|---|---|---|
1 |
Open the backup. Connect the external drive and open the cloud backup. |
Both open without errors or password problems |
2 |
Restore one photo and one document from each backup to a temporary folder (not over the originals). |
Files open correctly, and photos look right |
3 |
Check freshness. Look for something created in the last week. |
Recent files are present |
4 |
Check space and warnings. Look at remaining storage and any failed-backup notices. |
At least 20% free and no unresolved errors |
5 |
Log the result. Write the date and result below. |
Entry saved |
Date |
Phone backup OK? |
External drive OK? |
Cloud OK? |
Problems / fixes |
|---|---|---|---|---|
[date] |
Yes / No |
Yes / No |
Yes / No |
|
Once a year, go a step further: pretend your phone is lost and check that you could really restore it to a new device, including your two-factor authentication access and password manager.
Which copy saves you in which disaster?
What goes wrong |
Original |
External drive |
Cloud |
|---|---|---|---|
Phone lost or stolen |
Lost |
Safe (if photos were copied) |
Safe |
Accidental deletion |
Lost |
Safe (if not yet overwritten) |
May be gone if synced; check version history |
Hard drive or phone failure |
Lost |
Safe |
Safe |
Ransomware on your computer |
Encrypted |
At risk if connected at the time |
Safe if version history is available |
Fire, flood or burglary at home |
Lost |
Lost |
Safe |
Cloud account locked or hacked |
Safe |
Safe |
At risk |
No single copy covers every row. That is the point of having three.
What are the most common backup mistakes?
- Treating sync as backup. See above.
- Never testing a restore. A backup that cannot be restored is not a backup.
- Leaving the drive always connected. It can be damaged or encrypted along with your computer.
- Forgetting the cloud storage limit. When free storage fills, new backups can silently stop. Check your usage regularly.
- Not backing up for months. Providers can delete old device backups if a device has not backed up for a long period, so check the current policy for your service.
- Losing the encryption password or recovery key. An encrypted backup without its key cannot be opened.
- Backing up everything and organising nothing. Focus first on irreplaceable files so that the important things are always covered.
Which setup fits you?
You are… |
Minimum 3-2-1 setup |
|---|---|
A phone-only user with lots of photos |
Phone + cloud photo/device backup + a yearly copy of photos onto an external drive or computer |
A student or home user with a laptop |
Laptop + external drive (Time Machine or Windows Backup) + cloud sync/backup of Documents |
A freelancer or small business owner |
Computer + external drive + a dedicated cloud backup service with version history, plus a second drive stored offsite |
Your 3-2-1 checklist
- ☐ I listed my irreplaceable files and where they live
- ☐ Phone cloud backup is on and has enough space
- ☐ Photos are backed up to the cloud and also copied to another device or drive
- ☐ An external drive holds a recent backup and is disconnected when idle
- ☐ My cloud account has a strong password and two-factor authentication
- ☐ One copy is kept away from home or disconnected
- ☐ I have a monthly reminder to run the restore test
Frequently asked questions
What is the 3-2-1 backup rule in simple terms?
Keep three copies of your important data, store them on two different types of storage, and keep one copy somewhere other than your home. The original counts as one of the three copies.
Is iCloud or Google Photos a backup?
It is a good start, but photo services mostly sync your library, so deletions and problems can spread. Treat them as one copy and add an independent backup, such as an external drive.
How often should I back up my phone and computer?
Phone cloud backups should run automatically, usually daily. Computer backups should also be automatic where possible, with an external drive connected at least weekly for important files. Test restores monthly.
What is the difference between a backup and a sync?
A sync keeps two or more locations identical, so changes and deletions are copied across. A backup keeps a separate copy, often with older versions, so you can recover something that was deleted or damaged.
How big should my external drive be?
Choose one that is at least as large as everything you want to protect, and ideally about twice as large so it can hold older versions. If you back up several devices, add up their sizes.
What is 3-2-1-1-0?
It is an extended version of the rule used by businesses. It adds one copy that is offline or cannot be changed (protection against ransomware) and zero errors after testing the backups. Home users can get most of the benefit by disconnecting one drive and running the monthly restore test.
