If you have decided to protect the photos, videos and documents that matter to you, the practical question is a simple one: how do you set up a backup that genuinely works?
Copying everything to a USB stick once a year is not enough: you forget, the stick ends up in a drawer, and on the day you need it the copy is months out of date. What does work is a simple, well-tested method, the 3-2-1 backup rule, put in place in stages and then left to run on its own.
A backup is a safety copy of your files, kept somewhere other than the original, from which you can recover them if your device breaks, goes missing or is compromised. This post organises the countermeasures into four moments: prevent the loss, detect whether your backup has stopped working, respond when something goes wrong, and recover afterwards. It is the practical, hands-on side of the recommendation on backing up photos and videos.
Before you start: the rule in one line, and an order of priority
The 3-2-1 backup rule can be summed up like this: three copies of your data, on two different types of storage, with one kept away from home.
- Three copies means the original plus two safety copies. If one fails, you still have two.
- Two types of storage means two different kinds of memory, for example an external hard drive and a cloud service (storage space on servers you reach over the internet). A fault that affects one type of storage is unlikely to affect the other at the same time.
- One away from home means that at least one copy lives in a different physical place: if something happens at home — a burglary, a flood, an electrical fault — that copy stays intact.
Not all files carry the same weight. Some are irreplaceable; others can be downloaded again in a few minutes. The order of priority that works in almost every case is this one:
- family photos and videos — they exist nowhere else;
- personal and household documents — scans of identity documents, medical reports, contracts, receipts, tax returns;
- work and study files you are currently using;
- important messages and attachments that you keep only on your phone;
- contacts, calendar and notes;
- everything else — music, films, programs — which can usually be recovered from the original source.
If you have twenty minutes, spend them on the first two. That is worth more than an hour spent copying folders you could simply download again.
1. Prevention: reducing the risk before anything happens
Choose your two types of storage
What to do. The first is almost always an external drive that you connect to your computer with a cable; the second is a cloud service. Instead of the cloud, you can use a second drive, as long as you keep it somewhere else. The choice between the two, with their strengths and limits, is covered in the post on cloud or external drive backup.
Worth weighing up. If you choose the cloud, go for a reliable, privacy-respecting service that states clearly where it stores your data and offers encryption: a process that scrambles your files so that they are unreadable to anyone without the key.
Keep one copy away from home
What to do. The cloud solves this on its own. If you would rather stay offline, rotate two drives: one at home, one at a relative’s house or at work, and swap them from time to time — for example once a month, or after a trip with lots of photos.
Automate your backup
What to do. Both your computer’s and your phone’s operating systems include a built-in backup feature that you can schedule. Set it up so that it runs by itself: every day for your phone, while it is charging and connected to Wi-Fi; every week for your external drive.
Why it counts. A backup that depends on someone remembering will sooner or later be skipped. An automatic one carries on even in the weeks when you have other things on your mind.
Keep a version history
What to do. Check that your backup keeps a version history, meaning several copies of the same file saved at different moments. That way you can go back to yesterday’s version, or last month’s.
Good to know. Syncing — the feature that keeps a folder identical across several devices — is not a backup. If you delete a photo from your phone, syncing deletes it everywhere else too. A backup with version history, on the other hand, keeps it.
Encrypt your backup and protect it with a strong password
What to do. Turn on encryption for your external drive and, where possible, for your cloud backup. If someone finds or steals the drive, all they see is unreadable data. The reasoning is the same as in the recommendation on encrypting your personal devices.
Don’t forget. Without the password, an encrypted backup is unreadable to you as well. Choose a long, unique passphrase — a string of several unrelated words — and keep it in a password manager, an app that stores your credentials in protected form: how to do that is explained in the post on storing passwords safely. Keep a paper copy too, somewhere safe and away from the drive.
Disconnect the drive when it has finished
What to do. Connect your external drive for the backup and unplug it when it is done. An offline copy, meaning one your computer cannot reach, stays protected from an electrical fault and from ransomware and personal files attacks — malicious software that encrypts your files and demands a ransom to give them back.
2. Detection: noticing early
Check the date of your last successful backup
What to do. Once a month, open the backup settings on your phone and your computer and look at the date of the last completed copy. If it has not moved for weeks, something has stopped without telling you.
Keep an eye on free space
What to do. A full cloud account or a full external drive is one of the most common reasons why backups quietly stop. Free up space by removing duplicates, or increase your capacity before you reach the limit.
Read error notifications
What to do. Do not dismiss messages such as “backup not completed” or “unable to sync” without reading them. The cause is often trivial — a changed password, a withdrawn permission — and can be fixed in a minute.
Run a regular restore test
What to do. Every three months, pick a few files at random — a photo, a document, a video — and try to restore them from your backup to another device or another folder. Open them and check that they are intact. Restoring is the moment when a backup proves that it really exists.
The full list of warning signs is in the post on the signs your backup is not working.
3. Response: what to do when something goes wrong
Here, more than anywhere else, the order matters.
Don’t overwrite your good copies
What to do. If a device starts behaving oddly or your files appear damaged, pause your automatic backups and unplug the external drive. A new backup started from the damaged device could replace your healthy copies with damaged ones.
If your phone is lost or stolen
What to do. Use the locate, lock and remote erase features of your phone’s operating system; before erasing, check the date of the last backup in the cloud. Then change the password for the linked cloud account and sign out of the sessions open on that device. What happens when this preparation is missing is told in the post about a lost phone without a backup.
If your files have been encrypted by ransomware
What to do. Disconnect the device from the network and do not plug in any backup drive until the problem has been dealt with. Ask a knowledgeable person for help. Before even thinking about a ransom, check whether you have an offline copy or an earlier version in the cloud: it is often the way out.
Identify the right version to restore
What to do. Find the date of the last copy that was definitely healthy, before the incident, and restore from that one. If you have two copies, compare them: one may cover what the other is missing.
4. Recovery: getting back to a stable state
Restore to a clean, up-to-date device
What to do. Before bringing your files back, make sure the device has been repaired or reinstalled and that its system is up to date. The reason is explained in the recommendation on keeping your software up to date.
Check what you have recovered
What to check. Open a sample of files from each folder: recent and older photos, documents, videos. Check that the dates are what you expect and that no whole folders are missing.
Rebuild your three copies straight away
What to do. After a restore you often find yourself one copy short: the broken device, the drive you used to recover. Put the 3-2-1 rule back in place before going back to normal.
A word of caution. Be wary of anyone who contacts you first offering to “recover your files” for a fee. If you do need a data recovery service, choose it yourself, starting from official and verifiable channels.
Fix whatever was missing
What to do. If you lost something, ask yourself why: backups too infrequent, a folder left out, a drive forgotten. Adjust the setting and make a note of it.
A plan in three twenty-minute sessions
If the idea of “backing up everything” stops you before you even begin, here is a version you can do in three sittings. The time shown is yours: the copying itself may take hours, but it runs on its own while you do something else.
Session 1 — The irreplaceable files (20 minutes)
- Work out where your important photos, videos and documents are: phone, computer, old USB sticks.
- Gather them into a few clearly named folders.
- Connect an external drive, turn on encryption and start the first copy.
- Save the drive’s password in your password manager.
With this one session alone, you already have two copies of the files that exist nowhere else.
Session 2 — The copy away from home, and automation (20 minutes)
- Choose a reliable cloud service with encryption, or a second drive to keep elsewhere.
- Turn on your phone’s automatic backup, with version history.
- Schedule a weekly backup of your computer to the external drive.
- Check your free space and estimate how much you will need over the next year.
Session 3 — The test and the upkeep (20 minutes, repeatable)
- Restore three random files from your backup and open them.
- Check the date of the last successful backup on each device.
- Put a reminder in your calendar every three months to repeat the test.
In three weeks, twenty minutes at a time, the 3-2-1 backup rule is up and running and asks for no more attention than a check now and then.
Frequent mistakes when setting up a backup
Even people who decide to take action often stumble at the same points.
- Treating syncing as a backup. It copies deletions and damaged files too: you need version history.
- Leaving the drive plugged in all the time. A fault or malicious software that hits the computer can reach the drive as well.
- Keeping every copy at home. A burglary or a flood can take the original and the copy at the same time.
- Never testing a restore. A backup that has never been checked is a hope, not a guarantee.
- Losing the password to an encrypted backup. Without the key, your files stay unreadable to you too.
- Stopping at the phone. The oldest photos are often on a computer or on forgotten USB sticks.
- Putting it off because “it takes too long.” That is exactly why the three-session plan above exists.
Operational checklist
Stage 1 — Secure the irreplaceable
- ☐ Important photos, videos and documents gathered in clearly named folders
- ☐ First copy to an encrypted external drive completed
- ☐ Backup password saved in the password manager and on paper
Stage 2 — Complete the 3-2-1 rule
- ☐ Second copy on a different type of storage
- ☐ One copy kept away from home
- ☐ Version history turned on
Stage 3 — Automate and monitor
- ☐ Automatic backup scheduled on phone and computer
- ☐ Free space checked
- ☐ Error notifications read and resolved
Stage 4 — Verify
- ☐ Restore test carried out successfully
- ☐ External drive unplugged when not in use
- ☐ Reminder set for the next check in three months
A short scenario
One morning John’s computer will not start: its internal drive has failed.
He does not panic, and he does not plug his external drive straight into the repaired computer. He waits for the technician to reinstall the system and update it. Then he restores from the external drive and discovers that the last copy is three weeks old: the reminder had gone off and he had ignored it. The photos from those three weeks, however, are in his phone’s cloud backup, with version history. He recovers them from there.
An hour’s work, and not a single file lost. The two copies covered for each other: exactly what the 3-2-1 rule promises. That evening John switches the weekly backup back on and sets a new reminder.
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Skills | Knowing how to set up a backup that is automatic, encrypted and spread across two types of storage |
| Awareness | Understanding the difference between syncing and backing up |
| Secure Behaviour | Turning the restore test into a regular habit, not a reaction |
Reference level: FL2 — Beginner. This is the level at which you know the main risks and regularly apply a few well-chosen settings, following clear guidance and without needing technical expertise.
Conclusion
The 3-2-1 backup rule does not call for special equipment or specialist skills: an external drive, one copy away from home, well-configured automation and a test every so often. The system does the rest, even on the days when you are not thinking about it.
What to do right now. Connect an external drive today, turn on encryption and copy the photos and documents that exist nowhere else. If this is all you do, you already have a second copy of what matters most.
To see where you stand, the digital resilience self-assessment gives you a reference point.
Related content
- Backing up photos and videos — the recommendation this belongs to
- Cloud or external drive backup — the tools that make these fixes sustainable
- Signs your backup is not working — what to watch in order to notice in time
- Lost phone without a backup — what you avoid by acting early
- Ransomware and personal files — what you are protecting yourself against
Related resources
Short reads from the Resources section, for anyone who wants to focus on a single aspect:
- Data Backup: The Only Protection That Works Afterwards
- Data Encryption: Already On, and Worth Understanding
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
