Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The 3-2-1 rule is the right starting point for ransomware-resistant backups: keep three copies of important data, on two different media types, with at least one copy offsite. To withstand ransomware, add controls the basic rule does not specify—keep one copy outside ordinary production access, encrypt the data, preserve earlier usable versions, monitor backup activity, and regularly prove that restoration works.
What the 3-2-1 backup rule actually requires
The rule describes the shape of a backup system, not a particular product. HHS Office for Civil Rights explains it as three copies of data in total: the production copy and two backup copies; those copies should use two different media types; and at least one copy should be kept offsite. Its examples include local disk, hosted cloud storage and removable media.
| Element | What it means | Example |
|---|---|---|
| 3 copies | One working production copy plus two independent backup copies | Live file server, local backup repository and a separate cloud or removable copy |
| 2 media types | Do not place every copy on the same storage technology or failure domain | Disk-based storage plus cloud object storage, or disk plus removable media |
| 1 offsite copy | At least one copy is outside the location where the production systems operate | A geographically separate facility or hosted service |
Counting three folders on one server as three copies does not satisfy the intent. A storage failure, administrator error or ransomware process that can reach that server could affect all three folders at once. Independence matters more than the label attached to a copy.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why 3-2-1 alone does not stop ransomware
Ransomware commonly runs with the permissions of a compromised user, service account or administrator. If that identity can browse, overwrite or delete backup repositories, malware can attack the backups after encrypting production data. CISA and the Multi-State Information Sharing and Analysis Center (MS-ISAC) therefore state in their 2023 Ransomware Guide: “It is critical to maintain offline, encrypted backups of data and to regularly test your backups.”
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
An offsite copy is not automatically offline. A cloud repository in another region may still be reachable through the same stolen credentials, management console or API keys used for production. Conversely, a removable disk stored in the same building is offline while disconnected but is not resilient to fire, theft or a site-wide event. Your design needs both geographic separation and a separate access path.
NIST’s Tips and Tactics: Preparing Your Organization for Ransomware Attacks says to “Carefully plan, implement, and regularly test a data backup and restoration strategy.” The practical implication is that a backup job showing “successful” proves only that a process completed. It does not prove that the files are complete, that encryption keys are available, that an earlier clean version remains, or that systems can be rebuilt within the required time.
A ransomware-resilient architecture
Start with the 3-2-1 layout, then add four protections: a meaningful access boundary, encryption with separately protected keys, retained versions that predate an attack, and tested recovery. The following pattern works for many organizations, but the exact technologies and schedules must follow your recovery requirements.
Production copy
Keep the live data and applications in the production environment. Document which systems are authoritative, which data is transient, and which dependencies are required to operate. A database dump alone may not be enough if the application, configuration, identity service or encryption key is also needed to use it.
Local backup copy
Use a nearby repository for fast restoration of accidentally deleted files, corrupted databases or a failed server. Restrict write access to the backup service, separate its administrative credentials from production accounts, and prevent ordinary workstation users from browsing the repository.
Separated offsite copy
Send another copy to a different facility or hosted environment. Treat the offsite account as a high-value system: use unique administrator credentials, multifactor authentication where available, separate API keys, and alerts for deletion, retention changes or unusual download activity. Offsite placement addresses site loss; it does not by itself address credential compromise.
Offline or strongly isolated copy
Keep at least one version disconnected from ordinary network paths, or protected by a separate control plane that compromised production credentials cannot alter. A removable medium can provide physical separation when it is disconnected and stored safely. An immutable repository can help when its retention lock, deletion process and administrator separation genuinely resist compromised credentials. “Immutable” is not a substitute for restore testing: a locked, unusable or incomplete copy is still a recovery failure.
How to build the strategy step by step
1. Identify what must be recovered
List business services, personal data, shared files, databases, virtual machines, endpoints, configuration, identity systems and critical third-party dependencies. For each item, record its owner, location, backup method, administrator and acceptable data loss. Include data that is difficult to recreate, not just data that is large or expensive.
Classify systems by business impact. A payroll database, customer records system and manufacturing controller may need different recovery priorities from an archive of old documents. For operational technology, NIST SP 1339 (June 2026) provides a backup quick-start guide scoped specifically to OT environments; do not assume a procedure designed for office systems can be applied unchanged to safety- or process-control networks.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
2. Define recovery point and recovery time targets
The recovery point objective (RPO) is the maximum acceptable amount of data that could be lost, measured in time. The recovery time objective (RTO) is how long a service may remain unavailable. These targets determine backup cadence, replication choices, storage capacity and staffing.
There is no government-prescribed schedule that fits every organization. A system with a four-hour RPO may need several capture points each day; a low-change archive may need less frequent copies. Retention should reflect legal and operational risk, the likelihood that corruption will go unnoticed, storage capacity and the time required to investigate an incident. The UK National Cyber Security Centre’s Principles for ransomware-resistant cloud backups (22 November 2024) emphasizes aligning retention with risk appetite and monitoring and testing the result.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Map every administrative path
Draw how production systems, backup agents, repositories, cloud consoles, identity providers and management workstations authenticate. Mark which accounts can create, modify, delete or shorten retention. Remove unnecessary write permissions, use separate backup administrators, and keep emergency credentials in a controlled process that does not depend on the compromised production domain.
Limit network routes from user devices and production servers to backup storage. A backup server that accepts connections from every workstation has a larger attack surface than one reachable only by approved backup agents and administration networks.
4. Select two genuinely different media or storage domains
Choose media that fail differently. A local disk repository paired with a hosted copy is different from two folders on the same storage array. A disk repository paired with rotated removable media introduces a separate physical and administrative path. Document what “different” means in your design: technology, credentials, network, facility or all of these.
5. Add offline, immutable or otherwise isolated protection
Decide which copy ransomware cannot reach through ordinary production credentials. Options include disconnected removable media, a repository accessible only through a separate management network, or a service with retention controls that cannot be removed by a compromised day-to-day account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For removable media, define who rotates it, how many sets exist, where each set is stored, how it is labeled, and how it is scanned before use. For an immutable system, verify the retention period, clock source, deletion approvals, credential separation and behavior when an administrator account is compromised. Ask whether an attacker can overwrite the newest version, delete all versions, change retention or disable the backup job.
6. Encrypt data and protect keys separately
Encrypt backups in transit and at rest. Keep key-management access separate from production administrator access, and document how authorized staff retrieve keys during an incident. A backup encrypted with a key stored only on the damaged production server may be technically intact but practically unavailable.
Keep recovery secrets, service-account credentials and multifactor recovery methods in a protected system with an offline or otherwise independent access procedure. Test that procedure; discovering during an outage that a key vault depends on the unavailable identity service can extend the incident.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
7. Configure cadence and retention from the targets
Set capture frequency to the RPO, then verify that the resulting workload fits network bandwidth, storage capacity and backup windows. Keep enough historical versions to cover the period in which ransomware could remain unnoticed. A short retention window may preserve only encrypted versions if an attack is detected late.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Retention should be documented per system rather than copied blindly across the estate. Note whether a setting is a rolling number of versions, a number of days, or a legal hold; these behave differently when data changes rapidly.
8. Monitor for failure and destructive activity
Alert on missed jobs, unusual volume changes, failed authentication, disabled agents, deletion requests, retention changes, encryption-key errors and sudden access from new locations. Review logs often enough that a destructive action is discovered before the retention window expires. Keep an audit trail outside the backup system when possible so an attacker cannot erase both the event and its evidence.
9. Test integrity and restoration
Use several layers of testing:
- Availability checks: confirm that expected jobs ran and that repositories can be reached by authorized staff.
- Integrity checks: validate checksums, catalogues, database consistency or application-level verification where supported.
- File-level restores: recover representative files and confirm permissions, metadata and usability.
- System restores: rebuild a server, virtual machine or workstation from backup and required configuration.
- Scenario exercises: restore prioritized services in an isolated or controlled environment, using the contacts and credentials that would be available during an incident.
Record the restore point used, start and finish times, missing dependencies, operator, result and corrective action. A failed test is valuable when it leads to a fix; an unrecorded test cannot demonstrate readiness.
10. Maintain a recovery plan and gold images
NIST recommends defined recovery roles and regular exercises. Name the incident lead, backup administrator, system owners, security contact, communications lead and decision-maker for rebuilding or shutting down systems. Store contact details and procedures where they remain available if the normal collaboration platform is unavailable.
Maintain current gold images or system templates for critical systems when rebuilding from a clean baseline is faster or safer than repairing an infected installation. Include operating-system versions, application packages, configuration, licensing information and hardening steps. Test that the image works with current data and dependencies; an outdated image can create a second outage after the ransomware event.
Comparing backup implementations
Use the following criteria when evaluating an architecture or service. No option is automatically sufficient, and a design may combine several of them.
| Implementation | Separation from production access | Deletion and version protection | Earlier-version recovery | Operational considerations |
|---|---|---|---|---|
| Local disk repository | Good only when network routes and credentials are restricted; otherwise malware may reach it | Depends on repository permissions and retention controls | Available if multiple versions are retained | Fast for local restores, but vulnerable to the same site, power and network events |
| Hosted offsite backup | Geographically separate, but still exposed if attackers obtain console credentials or API keys | Depends on deletion controls, retention locks and independent administration | Requires explicit version retention and a tested restore path | Can scale geographically; monitor account activity, fees, bandwidth and restore time |
| Disconnected removable media | Strong while physically disconnected and credentials are not stored on production systems | Depends on disciplined rotation, physical custody and write protection where available | Only as good as the number and age of retained sets | Low network exposure; slower manual handling and vulnerable to loss, damage or poor labeling |
| Immutable or retention-locked repository | Potentially strong if the control plane and administrators are independent | Retention settings may resist deletion, but implementation details matter | Works when earlier versions remain within the lock period | Requires careful testing of expiry, emergency access, monitoring and restore scale |
Evaluate every option for encryption and independent key access, restore speed, practical recovery scale, geographic resilience, monitoring, auditability and ease of routine restore testing. A feature that exists in a service description but has never been exercised in your environment should be treated as unverified.
How often should backups and restore tests run?
Backup frequency follows the RPO; restore-test frequency follows the risk of failure and the rate of change. Critical systems, rapidly changing data and short RTOs justify more frequent tests than static archives. Test after major architecture, application, credential, retention or media changes, and after any incident affecting backup jobs.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
A sensible program uses a schedule with different depths rather than one universal interval:
- Routine automated checks for every backup cycle.
- Regular sample file and database restores for systems with active business use.
- Periodic full-system or service-level exercises that measure the actual RTO.
- At least one scenario exercise that assumes production credentials or the primary site are unavailable.
Set the exact interval in the system’s risk record, obtain owner approval and revise it when data value, threat exposure or recovery targets change. The important outcome is evidence that the needed version can be found and used, not a calendar entry marked complete.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can a cloud backup count as the offsite copy?
Yes, a hosted cloud copy can satisfy the offsite part of 3-2-1 when it is genuinely separate from the production location. It does not automatically satisfy the offline or access-separation requirement. Use unique credentials, multifactor authentication, separate administrative roles, retention and deletion controls, version history, logging and tested restoration. Confirm that an attacker with production credentials cannot erase every version or shorten retention.
Ask the provider or internal team how quickly a large restore can be delivered, whether earlier versions remain available, how keys are managed, how administrative actions are logged and what happens if the account is locked. These answers determine practical recovery, not the word “cloud” alone.
Is an external hard drive enough?
An external hard drive can be one component of a resilient design, especially for a disconnected copy. It is not a complete ransomware strategy by itself. Keep it disconnected except during controlled backup or restore operations, rotate more than one set, store the current set away from the production site, encrypt it, protect the encryption keys separately and verify that the drive can be read and restored.
Plan for drive failure, theft, accidental overwriting, malware infection during connection and outdated data. Label media with dates and retention information without exposing sensitive contents, maintain a custody log, and use a safe computer or isolated environment for restore tests. HHS OCR lists removable media as an example backup medium; its newsletter is written in a HIPAA contingency-planning context and is not a blanket legal conclusion for other organizations.
Common failure modes and fixes
| Symptom | Likely cause | Corrective action |
|---|---|---|
| All copies were encrypted | Repositories were reachable with production credentials or shared the same network | Create a separate administrative boundary, disconnect one copy and review deletion permissions |
| Backups report success but files cannot be opened | Integrity was never checked, or keys and application dependencies were missing | Add integrity validation, key-retrieval tests and application-aware restores |
| The only clean version is too recent | Retention was shorter than the time needed to detect the attack | Extend historical version retention according to risk and test that older points remain recoverable |
| Cloud data exists but cannot be restored in time | Bandwidth, export limits, credentials or rebuild steps were not tested | Measure a realistic restore, document alternate access and maintain prioritized recovery procedures |
| Removable media is missing or unreadable | No rotation, custody record or media-health check existed | Use multiple labeled sets, secure storage, periodic readability checks and documented ownership |
| Recovery team cannot coordinate | Roles and contacts were stored only in the compromised environment | Keep an offline or independently accessible plan and rehearse decision-making |
| Gold image rebuild fails | Image, patches, drivers, licenses or dependencies are outdated | Refresh the baseline and include it in full recovery exercises |
A practical readiness checklist
- Three total copies exist, including production and two backups.
- At least two media or storage types are used.
- At least one copy is offsite.
- At least one copy is offline or protected by a separate access boundary.
- Backup administrators and encryption-key administrators are not the same ordinary production account.
- Retention preserves versions old enough to precede a delayed ransomware discovery.
- Deletion, retention changes and unusual access generate alerts and audit records.
- Representative files, databases and complete systems have been restored successfully.
- Recovery roles, contacts, priorities and rebuild steps are available without the normal production environment.
- Gold images or system templates are current where they are part of the recovery design.
- Test results, gaps and corrective actions are recorded and reviewed by system owners.
Putting the rule into an incident plan
When ransomware is suspected, preserve the backup evidence and stop destructive access before attempting broad restoration. Isolate affected systems, protect clean backup credentials, identify the last known-good versions, and prioritize services using the recovery plan. Restore into a controlled environment when possible, validate systems before reconnecting them, and investigate how the attacker reached production and backup administration.
After recovery, rotate exposed credentials and keys, review retention and access logs, update gold images, and repeat the restore exercise for any failed step. The 3-2-1 rule gives you a durable starting architecture; resilience comes from separation, protected versions, independent secrets and demonstrated recovery.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
