Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The 3-2-1 rule is a starting architecture, not a guarantee. Keep at least three copies of critical data on two different media types, with one copy offline and immutable, then regularly prove that you can restore it. That extra isolation matters because ransomware can encrypt connected backups, while wiper malware is intended to destroy or irreversibly corrupt systems and data.
A resilient design combines a fast local backup, a second medium such as a rotated external drive or tape, and—when the risk and budget justify it—an isolated cloud or object-lock copy. Separate backup administration from everyday credentials, encrypt data and keys, protect configurations and identity services, and rehearse clean recovery.
What does the 3-2-1 backup rule require?
The operational baseline is three copies of important data, stored on two different media types, with one copy offline and immutable. The Federal Bureau of Investigation phrases it as: “Follow the 3-2-1 backup rule: maintain at least three copies of critical data on two different media types, with one stored offline and immutable.”
“Copy” means an independently recoverable version, not merely three pointers to the same live files. A production database, a backup on the same storage array, and a continuously synchronized replica can all be lost or overwritten by one compromised administrator account or one destructive event. Count copies only when they have a meaningful separation in media, failure domain, credentials or location.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
The UK National Cyber Security Centre describes ordinary 3-2-1 as at least three copies, on two devices, with one off-site. Off-site is useful for fire, theft and site-wide outages, but it does not automatically mean offline: an off-site system connected over a network can still be encrypted or deleted during an attack. For ransomware resilience, add an explicit isolation requirement—physical disconnection, an air gap, or cryptographic immutability with a retention lock that attackers cannot shorten.
Offline and immutable are different controls
- Offline: the copy is disconnected from networks and cannot be reached through normal attack paths. A USB drive that remains plugged into a server is online for this purpose.
- Immutable: the data cannot be altered or deleted for a defined retention window, even by ordinary backup or storage operations. Object-lock retention and write-once media are examples; a normal writable disk is not immutable.
You can use one control or both, but they address different failure modes. Offline media reduce reachability; immutability protects versions from modification and deletion while they remain in a storage service.
Why do ransomware and wiper attacks change the recovery problem?
Ransomware commonly encrypts production data and may target backup catalogs, snapshots and credentials so the victim cannot recover without negotiating. Wiper malware goes further: its purpose is destruction or irreversible corruption rather than a recoverable encryption event. The Belgian Centre for Cybersecurity states that once a wiper attack is fully executed, recovery depends entirely on uncompromised backups. MITRE ATT&CK also documents destruction of backups as a data-destruction technique.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →That threat model changes the order of priorities. A backup job that completes successfully but leaves every copy connected to the same identity system may provide no recovery path after an administrator account is stolen. Isolation, rapid containment and a known-clean rebuild path matter as much as backup frequency.
CISA and partner agencies advise maintaining offline, encrypted backups and regularly testing their availability and integrity in a disaster-recovery scenario. Their guidance also calls for golden images, protected configurations and identity systems—not just user documents—because a clean file copy is insufficient if the operating system, directory service, certificates or application dependencies are gone.
How do I design a 3-2-1 system that can survive an attack?
Build the design from business impact and attack paths, then assign each copy a distinct role. The following sequence covers the controls that must be decided and documented.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Inventory what must be recovered. List critical files, databases, applications, virtual machines, configurations, licenses, certificates, identity services and external dependencies. Record owners and the order in which systems depend on one another.
- Set an RPO and RTO for each service. Recovery point objective (RPO) is the maximum acceptable data loss measured in time; recovery time objective (RTO) is the maximum acceptable outage. There is no universal value for either. Derive them from transaction volume, safety obligations, contractual commitments and the cost of downtime.
- Map three independent copies. Keep production data, a rapidly restorable local backup, and a second medium or failure domain. Add an isolated cloud or object-lock copy when geographic separation or longer retention is required.
- Use two genuinely different media types. For example, pair disk-based backup with a rotated external USB drive or tape. Three replicas on one storage platform do not meet the intent of two media types if one platform failure or administrative compromise can remove them all.
- Encrypt the backup data. Encrypt in transit and at rest, and store recovery keys separately from production credentials. A backup that is unreadable because its only key was destroyed is not a usable copy.
- Separate administration. Create dedicated backup administrator accounts with least privilege and multifactor authentication. Restrict the backup console to trusted management devices or a protected management network; do not reuse ordinary domain administrator credentials.
- Preserve the rebuild set. Include golden operating-system images, infrastructure-as-code, application installers, license information, configuration exports and identity-service recovery material in the protected backup set. Document how to obtain them when the primary network is unavailable.
- Disconnect physical media after each job. Rotate external drives or tape cartridges, label them, record custody and store them in a controlled location. Do not leave a USB drive permanently attached to the backup host.
- Lock cloud versions against deletion. Preserve previous versions and configure object-lock retention where supported. Review who can change retention, replication and account settings; a malicious synchronization event must not replace every good version.
- Schedule and document restore tests. Restore representative files and complete systems, verify integrity, measure elapsed recovery time and record every gap. Update the runbook when applications, credentials or dependencies change.
Which backup media should I use?
Choose media by isolation strength, resistance to deletion by a compromised administrator, restore speed and scale, geographic separation, encryption and key custody, retention and versioning, compatibility, monitoring and operational burden. No single medium supplies every control.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches| Option | Isolation and protection | Operational strengths | Trade-offs |
|---|---|---|---|
| Local backup storage | Fast but normally network-connected; vulnerable if attackers reach the backup infrastructure | Rapid restores for common file and system failures | Must be supplemented by an isolated copy |
| Rotated external hard drive | Can be physically disconnected between jobs; encryption is required for lost or stolen media | Inexpensive and simple for small data sets | Depends on disciplined rotation, labeling and physical handling; writable while attached |
| LTO tape cartridges | Strong offline separation when cartridges are removed and secured | Suitable for large-scale offline retention | Requires compatible tape drives, inventory control and restore expertise |
| Immutable cloud or object-lock storage | Logical immutability and geographic separation when retention is locked | Convenient remote copy, versioning and scalable capacity | Account compromise, misconfiguration, retention cost and provider dependency must be tested |
An external hard drive for offline backups is useful only as part of a workflow: encrypt it, run the backup, verify that it completed, disconnect it, and rotate another drive. The drive itself is not immutable, and a connected drive can be encrypted or wiped along with the host.
How do I make an offline copy genuinely safe?
Start with the point at which the backup job ends, not with the hardware purchase. A practical rotation procedure is:
- Use a dedicated backup account to start the job and write to the removable medium.
- Verify job status, file counts or catalog completion, and an integrity check before removal.
- Unmount or eject the medium through the operating system so buffered writes finish.
- Disconnect the cable or remove the cartridge; do not rely on a software “offline” flag while the device remains reachable.
- Label the medium with its coverage period and encryption-key reference, then place it in controlled storage with a custody log.
- Bring a different medium into the rotation for the next job, preserving earlier versions long enough to cover delayed detection.
Keep at least one rotated copy outside the primary site when a local disaster could destroy both production and the backup room. Physical security, humidity and temperature controls, transport procedures and the ability to read the format years later are part of the recovery design.
How should I secure backup administration and cloud copies?
Attackers often seek the backup console because it can delete retention, disable jobs or push destructive changes to every replica. Put backup management on a restricted network, require multifactor authentication and use separate administrator identities that are not members of ordinary workstation or domain-administrator groups.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Limit each operator to the actions required for their role. Alert on retention changes, mass deletions, disabled jobs, unusual export activity and login attempts from untrusted devices. Keep an emergency recovery account protected under a documented break-glass process rather than sharing one permanent administrator password.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
For cloud or object-lock storage, separate the storage account from the production identity provider when possible, preserve historical versions and set retention that operators cannot shorten. Protect encryption keys independently and test account-recovery procedures; geographic separation does not help if the only administrative credentials are compromised in the same incident.
How do I test that backups will actually restore?
A successful backup-job message proves only that data was written. A restore test proves that the copy is readable, complete, clean and usable within the business time limit.
Test individual data and complete systems
- Restore representative documents, database records and application files to an isolated location.
- Restore a complete server or virtual machine from the protected copy, including operating system, configuration and required licenses.
- Rebuild identity and access dependencies in the order documented for the service; test that restored applications can authenticate without contacting a compromised production system.
- Scan restored data and images with current security tooling and investigate unexpected changes before reconnecting them.
Measure the result
Record the source copy and version, test date, person responsible, elapsed restore time, data-integrity checks, manual workarounds and unresolved failures. Compare elapsed time with the service’s RTO and the recovered data age with its RPO. A gap is an engineering task: change the backup schedule, storage capacity, network path, runbook or staffing, then repeat the test.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchTest after major application, identity, storage or backup-platform changes as well as on a regular risk-based cadence. Include a scenario in which the normal domain, management network or cloud account is unavailable, so the exercise validates the isolation assumptions rather than only the happy path.
What should I do when an attack is in progress?
Preserve the recovery path before attempting broad cleanup. Coordinate through an out-of-band channel if email, chat or directory services may be compromised.
- Isolate affected hosts and segments to stop encryption or wiping from spreading.
- Isolate backup servers, removable-media stations and cloud-management sessions; suspend synchronization that could overwrite clean versions.
- Protect logs and evidence while identifying the initial access, compromised identities and persistence mechanisms.
- Revoke or disable suspected credentials, including backup administrators, and rotate keys through a clean management device.
- Scan candidate backups and inspect timestamps, catalogs and retention history. Do not assume the newest copy is clean.
- Rebuild priority systems on known-clean hardware or images, starting with the dependencies needed for identity, networking and security monitoring.
- Restore in business-priority order, validating each service before reconnecting it to the wider network.
- After recovery, document which copies were usable, which controls failed and what changes will prevent recurrence.
What are the most common 3-2-1 design mistakes?
- Counting synchronized replicas as isolated copies: automatic synchronization can propagate encryption, corruption or deletion. Preserve historical versions and an isolated copy.
- Leaving the removable drive attached: a permanently connected USB disk is reachable during a host compromise. Rotate and disconnect it.
- Using one administrator identity everywhere: a stolen domain credential can control production and backups. Use separate accounts, least privilege and multifactor authentication.
- Backing up only user files: without configurations, golden images, licenses and identity recovery data, restoration stalls after the files are available.
- Never performing a full restore: catalog success does not reveal unreadable media, missing dependencies or an RTO breach. Restore complete systems and measure elapsed time.
- Assuming off-site means offline: a remote service remains exposed if it accepts network commands during the attack. Add physical disconnection or immutable retention.
- Ignoring key custody: encrypted data without an independently protected recovery key is effectively lost when production credentials or key servers are destroyed.
How should I choose RPO, RTO and retention?
Set these values service by service. A payment system that loses transactions every few minutes may need a much shorter RPO than an archive, while a noncritical reporting server may tolerate a longer outage. RTO must include detection, containment, clean-room preparation, data transfer, application startup, validation and user cutover—not just the time to copy bytes.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Retention should cover the period in which an intrusion could remain unnoticed, plus legal or operational requirements. Keep multiple historical versions so a clean point exists before corruption began; do not let an automated policy delete every earlier version immediately after a malicious synchronization event. The authoritative guidance provides no universal RPO, RTO or retention number, so document the business assumptions behind each value.
What is the practical bottom line?
Use 3-2-1 as the minimum shape of the system, then harden the recovery path. Three copies and two media types are useful only when at least one copy is outside ordinary network reach or protected by immutable retention. Encrypt data, isolate keys and administration, include the systems needed to rebuild the business, and repeatedly demonstrate a clean restore under attack conditions. That discipline—not the purchase of a particular drive, tape or cloud service—is what turns backups into ransomware and wiper resilience.
Frequently Asked Questions
Can a USB drive count as an immutable backup?
No. A USB drive can provide an offline copy when it is disconnected and physically secured, but it remains writable whenever it is attached. To obtain immutability, use write-once media or a storage system with retention enforcement that authorized operators cannot shorten.
Do storage snapshots by themselves satisfy 3-2-1?
Usually not. Snapshots on the same array or account share failure and administrative paths with production, so one compromise can encrypt or delete them together. Treat snapshots as a fast-recovery layer and add a separate medium or isolated failure domain.
What should a small organization buy first for offline backup?
Start with two or more encrypted external drives that can be rotated and stored separately from the workstation or server, plus a documented restore procedure. Add tape or immutable cloud storage when data volume, geographic risk or retention requirements exceed what removable drives can handle.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should a restore-test report contain?
Record the backup version used, systems and data restored, integrity checks, elapsed time for each phase, credentials or dependencies that were missing, and the owner and due date for every corrective action. Keeping those records lets management compare actual recovery performance with the service’s RPO and RTO.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
