iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Keep your everyday cloud files, but add two independent recovery paths: a separately secured copy in another service or on a local system, plus an encrypted drive that is disconnected and stored away from your computer. Automate copies, retain older versions, use separate credentials with multifactor authentication, and perform test restores. This arrangement follows the 3-2-1 pattern—three copies, two storage forms or devices, and one off-site copy—so a provider outage, account lockout, sync mistake, ransomware incident, fire or theft does not remove every copy at once.
What does a resilient cloud-storage backup look like?
Your normal cloud account remains the working copy. A backup is a separate, recoverable copy that does not depend on the same account, synchronization process or failure domain. For most households and small teams, the practical design is:
- Primary copy: the cloud service you already use for daily work.
- Independent copy: a second cloud service or a local NAS, protected by different credentials and multifactor authentication.
- Offline copy: an encrypted external hard drive that is connected only during a backup, then ejected and stored separately.
Automate the independent copy on a schedule that matches how quickly your files change. Keep several historical versions and a deleted-file recovery period. For irreplaceable records, add immutable or write-once retention so an administrator or malicious program cannot rewrite every version. Finally, document and rehearse restoration; a backup that has never been opened is an assumption, not a proven recovery plan.
Recommended Free Tools
How does the 3-2-1 backup rule apply to cloud files?
The 3-2-1 rule calls for three total copies, stored on two different storage forms or devices, with at least one copy off-site. The UK Department for Education Cyber Security Hub describes this pattern as a way to spread risk across locations and providers.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Three copies
Count the working cloud copy, the independent online or local copy, and the disconnected drive as three copies. A second folder inside the same account is not a third copy: an account deletion, billing problem, compromised password or provider outage can affect both folders.
Two storage forms or devices
Use materially different failure paths, such as cloud object storage plus an external disk. Two synchronized folders on the same computer do not provide that diversity. A NAS is a separate device, but it shares your building and network unless you deliberately isolate it.
One off-site copy
Store at least one copy in another location. A drive beside the computer can be lost to the same fire, flood or theft. Off-site can mean a second cloud provider or a physically separate place for the encrypted drive.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIs cloud storage itself a backup?
No. Cloud storage improves availability, but synchronization and provider recovery features are not the same as an independent backup. The UK National Cyber Security Centre warns that these mechanisms should not be the sole reliable backup for critical data.
Why synchronization can spread damage
A sync client is designed to make locations match. If ransomware encrypts a local folder, those encrypted files may synchronize to the cloud. If someone deletes a shared directory, deletion may propagate before you notice. A separate backup job should copy data in a way that preserves older states instead of mirroring every change immediately.
What version history and recycle bins can and cannot do
Version history and deleted-file recovery are valuable first-line recovery tools for accidental edits and recent deletions. Their retention periods, item limits and administrative controls depend on the provider and plan. They can also be unavailable during an account lockout or provider-wide incident, so retain an independent export as well.
How should I build the three-copy setup?
Build each layer for a different failure mode rather than making three identical synchronized copies.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute1. Keep the primary cloud account for daily work
Organize important folders consistently and identify what must be recoverable: documents, photos, project data, configuration files and records. Exclude caches and temporary files that add volume without recovery value. Turn on the provider’s version history and deleted-file recovery, then record the retention settings shown for your plan.
2. Create an independent copy
Choose another cloud provider or a local NAS. Use a different login identity from the primary account, enable multifactor authentication, and give the backup account the least permission needed to write or read data. Do not let the same administrator account control both services. If the software supports it, use append-only, immutable or write-once retention for critical folders.
Configure a scheduled export or backup job rather than relying on a desktop sync folder. Start with a full copy, then run incremental jobs that capture changed files and preserve prior versions. Encrypt data before it leaves your computer when the service does not provide suitable encryption controls, and protect the encryption key separately.
3. Make an offline encrypted copy
Use an external hard drive with full-volume encryption or a backup format that encrypts files before writing them. Run the job, verify that it completed, eject the drive through the operating system, and disconnect the cable. Store it in a separate, protected location; rotate a second drive if you need an off-site physical copy.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A permanently mounted USB disk is not offline in the security sense. Malware running under your account can often read, encrypt or delete it while it is connected. The UK National Cyber Security Centre and the US Cybersecurity and Infrastructure Security Agency both emphasize logical separation and frequent backups; the latter specifically advises backing up often to reduce permanent loss.
Which is better for the independent copy: external drive, NAS or another cloud?
No option wins in every environment. Select according to how much automation, capacity, off-site protection and hands-on recovery you can maintain.
| Option | Independence from primary provider | Offline or immutable protection | Automation and restore | Retention and access controls | Location and capacity | Cost considerations |
|---|---|---|---|---|---|---|
| Encrypted external drive | High when disconnected and maintained separately | Strong offline protection while ejected; immutability requires a suitable backup format or write-protected workflow | Usually requires a scheduled computer job; restores are fast for files on hand but manual if the computer is unavailable | Controlled by your backup software and rotation; you must create and preserve versions | Physical location; capacity is limited by the drive, and an off-site rotation is your responsibility | One-time hardware purchase plus replacement and storage; exact costs depend on capacity and model |
| NAS | Moderate to high; it is separate hardware but may share your network and credentials | Not automatically offline. It needs network isolation, snapshots, immutable retention or a shutdown schedule to resist ransomware | Convenient continuous or scheduled jobs and granular network restores; setup and maintenance are more involved | Snapshots and permissions can provide strong retention, but configuration errors can expose every version | On-premises location with expandable capacity; it remains vulnerable to local fire, theft and power events unless replicated elsewhere | Hardware, disks, power and maintenance costs; no single price is established here |
| Second cloud service | High if it uses a different provider, account and authentication path | Can offer immutable retention, but only when the selected plan and configuration support it; it is not physically offline | Best for unattended schedules and remote, granular restores when the service supports them | Retention, deletion protection, encryption and administrator controls vary by plan and provider | Off-site by design with scalable capacity; dependent on internet access and provider availability | Recurring storage, transfer and possibly restore fees; check the complete plan terms |
A NAS is a convenience and capacity choice, not an automatic ransomware shield. A second cloud service is attractive when you need remote recovery, while an external drive supplies the clearest disconnected copy. Many people use a NAS or second cloud for daily automation and rotate encrypted drives for offline retention.
How do I back up Google Drive or OneDrive without creating another sync trap?
Use an export or backup workflow that writes to a separately controlled destination and preserves versions; do not simply install a second sync client against the same live folder.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Inventory the source: list shared folders, files owned by other people, native online documents, large media and data that must be retained. Confirm that your chosen export method can represent native documents in a usable format.
- Select the destination account: create a dedicated account or storage namespace at another provider, or on your NAS. Turn on multifactor authentication and record recovery codes offline.
- Set permissions: allow the backup process only the access it needs. Remove broad sharing links and prevent ordinary users from deleting retained versions.
- Run an initial full export: keep a log of the date, scope and any skipped or unsupported items. Compare file counts and total size with the source.
- Schedule incremental backups: choose a frequency based on the amount of recent work you can afford to lose. Capture changed and deleted items as new backup records instead of mirroring deletions immediately.
- Back up the export metadata: preserve folder paths, timestamps, ownership information and any conversion notes that are needed to reconstruct the workspace.
- Copy critical folders to the encrypted drive: after the online job completes, run the offline job, verify it, eject the drive and store it away.
- Review alerts: configure notifications for failed jobs, authentication errors, quota limits and unusual deletion activity. A silent failure can leave you with only the primary copy.
Provider-specific export menus and supported formats change. Follow the current instructions for your edition, and test a representative native document, shared file and large file rather than assuming every item exported identically.
How often should cloud backups run, and how long should versions remain?
Set frequency by recovery-point objective: the maximum recent work you are willing to lose. Daily backups suit files that change once or a few times per day; active business or creative projects may need hourly or more frequent jobs. Run the offline drive copy at a cadence that keeps its contents within the same acceptable loss window, even if that means weekly rather than continuously.
Use a tiered retention plan
- Recent versions: keep enough daily or hourly points to cover editing mistakes and malware discovery.
- Longer history: retain weekly or monthly points for records that may need reconstruction later.
- Deleted-file period: preserve deleted items long enough to detect delayed mistakes; the exact window is plan-dependent.
- Immutable period: lock critical records for the period required by your legal, contractual or operational needs.
Microsoft documents up to 30 days of point-in-time OneDrive recovery for Microsoft 365 subscribers after ransomware or other loss. That is a documented maximum for the relevant subscription and event, not a universal promise for every OneDrive account or every file, so check the recovery window shown in your plan.
How do I protect backups from ransomware?
Assume an attacker will target both the computer and any backup that accepts the same credentials. Keep one copy disconnected or immutable, restrict backup permissions, separate administrator identities, and rehearse a clean restore.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Disconnect the external drive immediately after each verified job.
- Use a backup account that cannot administer the primary cloud account and cannot delete immutable versions.
- Require multifactor authentication and store recovery codes securely offline.
- Limit NAS management interfaces to trusted networks; disable unnecessary internet exposure.
- Enable snapshots or object-lock style retention only after confirming how expiration and emergency recovery work.
- Monitor for sudden encryption, mass deletion, impossible travel or repeated authentication failures.
- If an infection is suspected, stop synchronization before attempting recovery so damaged files do not overwrite good copies.
James L, a researcher cited by the UK National Cyber Security Centre, summarized the principle: “It is vital to keep multiple backups and to logically separate them.”
Rank #2
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How do I encrypt backups and manage access safely?
Encryption protects a stolen drive or intercepted transfer, but it introduces key-management duties. Use full-disk encryption on removable media or client-side encryption when appropriate, and keep the decryption key separate from the backup itself.
- Use a long, unique passphrase for each backup account and store it in a reputable password manager.
- Keep an offline recovery copy of encryption keys and multifactor recovery codes in a secure location.
- Give each person or service its own identity so access can be revoked without changing every job.
- Review sharing links, service accounts, API tokens and NAS administrators at least quarterly.
- Test that an authorized person can decrypt a restored file without exposing keys to ordinary users.
Encryption does not recover a forgotten key. Include key retrieval in your restore documentation and ensure that at least two trusted people can execute it when organizational continuity requires that.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I test that a backup can actually be restored?
Perform a restore drill on a schedule and after every major change to the backup system. Testing catches incomplete exports, incompatible formats, expired credentials and permissions that look correct until recovery is urgent.
- Choose a sample containing a small document, a large file, a folder hierarchy, a shared item and a native cloud document.
- Restore to a clean location or spare device, never over the only working copy.
- Open each file, check dates and versions, and compare hashes or file sizes where practical.
- Measure elapsed time from starting the job to having usable files; record internet and hardware dependencies.
- Write the exact sequence, account used, key location, software version and any conversion step.
- Repeat from the second cloud or NAS and from the disconnected drive. A plan is incomplete if only one path has been tested.
Keep the drill record with your continuity documentation. The UK National Cyber Security Centre and other public guidance consistently treat restore testing as part of backup, not an optional audit exercise.
What happens if the primary provider goes down or locks my account?
Stop treating the unavailable account as the recovery source. Switch to the independent provider or local copy, using its separate credentials and documented restore procedure. If the outage is temporary, avoid bulk changes that could create conflicts when service returns; work from a restored copy and reconcile changes deliberately.
An account lockout is different from a regional outage. Keep recovery codes, billing contacts and administrator identities outside the primary account, and ensure the independent backup job does not depend on the same single sign-on provider. For a prolonged incident, communicate which restore point is authoritative and record new work until normal service is safe.
What can go wrong, and how do I fix it?
The backup job reports success but files are missing
Compare source and destination inventories, including shared and online-native files. Check exclusion rules, conversion failures and quota errors, then rerun a full export for the affected folders.
Deleted files disappear from the backup
The job may be mirroring deletions instead of retaining historical states. Change the policy to versioned or append-only retention and test deletion of a harmless sample.
The NAS is encrypted during a ransomware event
Disconnect it from the network, preserve the offline drive, and do not log in from a potentially infected workstation. Restore to a clean system, rotate credentials and review network isolation before reconnecting the NAS.
The encrypted drive cannot be opened
Use the documented recovery key and a known-clean computer. If the key is unavailable, do not reformat the drive; locate the offline key record or a second rotated drive.
Restores are too slow
Prioritize critical folders, maintain a local encrypted copy for large data sets, and verify that the independent service offers granular rather than full-account restoration. Recalculate the schedule and retention after measuring an actual drill.
Free tools Windows power users keep installed
One-click scans. No signup required.
How much does a multi-copy backup plan cost?
Costs depend on capacity, retention, transfer volume, hardware life and the amount of administration you perform. An external drive generally concentrates spending in hardware and replacement; a NAS adds disks, power and maintenance; a second cloud adds recurring storage and potentially restore or transfer charges. Compare total cost over the period you expect to keep the data, including a second physical drive if you need rotation and off-site storage.
Do not select solely on the lowest storage price. A plan that lacks immutable retention, granular restore, multifactor authentication or useful alerts can cost more during an incident than a higher-priced service with those controls.
What should I document before an emergency?
- Which folders and accounts are protected, and the last successful backup time.
- Retention periods, immutable-lock settings and provider-specific recovery limits.
- Separate usernames, MFA methods, recovery codes and encryption-key locations.
- The restore order for critical systems, expected recovery time and acceptable data loss.
- Where the disconnected drive is stored and who can retrieve it.
- The date and result of the last restore drill, including files that could not be restored.
Review the document after changing providers, passwords, storage plans, network equipment or encryption software. An outdated runbook can fail even when the underlying files are intact.
Frequently Asked Questions
Can I use two accounts with the same cloud provider for redundancy?
It is better than a second folder in one account, but it does not remove provider-wide outage or policy risk. If both accounts share the same identity system, billing owner or administrator, a single compromise can still affect them; pair them with a local disconnected copy or a different provider.
Should I back up shared files that I do not own?
Yes, if your organization is responsible for them, but confirm that your export method preserves access, ownership and file format. Ownership changes or a teammate leaving can remove access even while your own account remains healthy, so include shared-item checks in inventory and restore tests.
What is the safest way to rotate offline backup drives?
Keep at least two encrypted drives, use one for the current job and store the other disconnected at a separate location. After verifying a new copy, swap the drives and record which date and restore point each contains.
How can I tell whether a backup service is truly immutable?
Look for a documented retention lock that prevents administrators or backup software from shortening or deleting the protected period. Test the permission model with a noncritical dataset and verify how legal holds, expiration and emergency recovery are handled.
What should I do first after discovering ransomware?
Isolate affected computers and stop synchronization so encrypted files do not propagate. Preserve the disconnected backup, investigate from a clean device, rotate credentials, and restore only after confirming that the chosen restore point predates the attack.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
