The 3-2-1 backup rule, applied to a normal household

Three copies of your data, on two kinds of storage, one kept off-site. The file you are working on is one of the three, so 3-2-1 means live data plus two backups, not live data plus three. That miscount is the most common way people read the rule wrong.

Where the rule comes from, and the digits Veeam added

Peter Krogh popularized 3-2-1 in "The DAM Book: Digital Asset Management for Photographers" (2009), when "two media" meant disk plus tape. Backblaze, which has every reason to defend the rule, concedes that as storage evolved it "has gotten a little...cloudy". Read that clause as isolation, not two literal formats.

Veeam extended it to 3-2-1-1-0: one more copy offline, air-gapped or immutable, and zero errors when a restore is verified. A password does not make a copy immutable. Immutable means the storage refuses the delete, whoever asks. NIST puts the same outcome in one line, CSF 2.0 control PR.DS-11: backups of data are created, protected, maintained, and tested. Tested is the word that gets skipped.

Sync is not backup

A sync client's job is to make every copy identical, so a destructive change gets propagated rather than resisted. What stands between you and loss is version history: short, a side effect rather than a promise, and gone with the file once you empty the trash.

Service, consumer tier	Retention	Catch
Dropbox Basic, Plus, Family	30 days	Permanent deletion destroys the version history too
Dropbox Professional, Essentials	180 days	Upgrades are not retroactive
Google Drive	30 days revisions, 30 in Trash	Purged early past 100 revisions not `keepForever`
Google Photos	60 days in Trash	30 days if never backed up
OneDrive, consumer	Files Restore, 30 days	Needs Microsoft 365; one free ransomware recovery otherwise
iCloud Photos	30 days in Recently Deleted	Apple: iCloud Photos is not duplicated inside iCloud Backup

Ransomware exploits that design mechanically. It encrypts the local folder, the client uploads the encrypted versions over the good ones, and a shared folder carries the damage to everyone connected. SafeBreach Labs published DoubleDrive, a proof of concept that turns OneDrive's own sync process into the thing doing the encrypting.

Sync clients also lose data unassisted. Google Drive for desktop 84.0.0.0 through 84.0.4.0 left a subset of users missing months of files, a bug Google confirmed in November 2023. Google shipped v85.0.13.0 and a recovery tool, then told the people it could not help to recover from Windows or Time Machine backups. The sync vendor pointed users at their real backup.

RAID is not backup

RAID buys uptime through a dead disk. It buys nothing against a bad write. A deletion, an overwrite, a corrupt block or a ransomware pass reaches every member disk as fast as it reaches the first, because propagating writes is the array's entire job. RAID also does nothing about controller failure, theft, fire, flood, a power surge, or reformatting the wrong volume.

Rebuilds are the second problem. Consumer NAS drives are typically specified at one unrecoverable read error per 10^14 bits, roughly one URE per 12.5 TB read; enterprise drives are spec'd at 10^15, roughly 125 TB. A RAID 5 rebuild reads every surviving member end to end with no redundancy left, so one URE mid-rebuild loses that stripe, and a 12 TB to 20 TB array reads enough to be in that territory. Ignore the claim that rebuild failure is therefore near-certain: the URE figure is a warranty floor, not a schedule.

Backblaze's Q1 2026 Drive Stats covers 341,263 drives and 1,030 failures, an annualized failure rate of 1.24% for the quarter. RAID cannot detect silent corruption either; checksumming filesystems can. Bairavasundaram et al. at USENIX FAST '08 examined 1.53 million drives over 41 months and found more than 400,000 checksum mismatches, nearline SATA drives faring an order of magnitude worse than enterprise ones.

How households actually get hit

Nearly every ransomware statistic describes organizations, so treat these as shape, not forecast; no credible household rate exists. Sophos surveyed 2,158 IT and cybersecurity decision-makers across 17 countries in Q1 2026: 79% of attacks began with compromised identities, and backup-based recovery reached 66% of encrypted-data cases, up 12 points year over year. Veeam's 2026 report supplies the contrast: 90% were confident of recovering inside their stated recovery times, and 28% of victims fully restored their data.

Households get there through infostealer malware, not a targeted attack: cracked games, fake launchers, malicious extensions and poisoned search ads, with families like LummaC2, Vidar and ACRStealer harvesting saved passwords, cookies and session tokens. That is the pipeline behind the 79%, and it reduces to one rule. A backup your own logged-in credentials can delete is not a backup.

Turn on Controlled Folder Access as well. It ships with Defender Antivirus on every Windows edition, Windows 11 Home included, and Microsoft's documentation is explicit that it is off by default. Switched on, it stops untrusted apps writing to Documents, Pictures, Videos, Music and Favorites, plus the boot sectors disk-wiper malware targets. Enable it under Windows Security, Virus and threat protection, Manage ransomware protection, or with Set-MpPreference -EnableControlledFolderAccess Enabled. It does nothing if a third-party suite has replaced Defender.

Offline or immutable, and you only need one

An unplugged external drive is unreachable by definition and costs nothing per month. Its failure mode is human: people leave it connected, and a connected USB drive sits inside the blast radius. Do not use an SSD for a drive that lives in a drawer. JEDEC's power-off retention requirement, JESD218, is one year at 30 °C for a client SSD and three months at 40 °C for an enterprise one, measured at the end of rated endurance, and worn drives hold less. Spinning disk for cold copies.

Option	Immutability	Limitation
Backblaze B2 Object Lock	Governance retention lifts only with `bypassGovernance`; compliance mode is stricter; legal hold never expires	Object Lock's cost is not published, so ask
Hetzner Storage Box	Read-only ZFS snapshots in `/.zfs/snapshot`, scheduled daily to monthly	Snapshots consume quota as data diverges
rsync.net Borg account	`authorized_keys` under your control, enforcing append-only	Still needs compaction from elsewhere
restic `rest-server --append-only`	Clients write and read, never delete	`forget` and `prune` need delete access from a separate host
Synology WriteOnce	WORM folders and immutable snapshots, license-free since DSM 7.2	Btrfs volume, and a model that supports it

What this costs in 2026

Western Digital and Seagate have sold their entire 2026 hard drive output. Chief executive Irving Tan told investors WD is "pretty much sold out" for calendar 2026, and Seagate's Dave Mosley said nearline capacity is allocated through 2026, with orders opening for the first half of 2027. heise reported German retail hard drive prices up 20% to 50% against mid-2025. A second big external drive costs materially more than in 2024 and may be back-ordered, so inside a few terabytes, rented storage is the cheaper marginal copy.

Backblaze Computer Backup is $99 per year per computer, unlimited, covering connected external drives. Its mailed restore is refundable, not free: you pay for the drive and get the money back if you return it within 30 days. Version history is 30 days by default, One Year Extended Version History is free to enable, and Forever Version History costs $0.006/GB/month on versions older than a year. Switch the free year on now. It covers the mistake you notice in March that happened in January. B2 went to $6.95 per TB per month on 1 May 2026, with Class A, B and C API calls now free and egress free to three times stored data. rsync.net Borg accounts are $0.01/GB/month, 200 GB minimum. Services advertising a first-year price, IDrive among them, renew higher. Lab recovery starts near $300, and $1,000 to $2,500 or more once a mechanical failure needs cleanroom work.

Four of the six consumer sync tiers stop at the same 30 days, and the one line here that costs nothing is also the one you have to remember to switch on.

Two setups, and the rule for choosing

For one Mac or PC, roughly $99 to $130 a year: live data, an external USB disk written by Time Machine or the free Veeam Agent for Microsoft Windows, and Backblaze off-site. Unplug it between runs and it is your local copy and your offline copy at once. With a NAS, or more than a terabyte, run restic 0.19.1 or BorgBackup 1.4.5 to rented storage with immutability from the table above, on Btrfs or ZFS so scrubs catch silent corruption. Stay on Borg 1.4.x; borgbackup.org says 2.0 is in testing and not for production. Duplicati broke its beta-only run in early 2025 and has shipped stable builds through 2026, so it deserves another look.

The external disk does double duty: it is the second kind of storage and, once unplugged, the offline copy, which is why a single paid off-site service completes the rule.

The choosing rule: the offline-or-immutable copy is not optional, and it is not the off-site copy unless the off-site one is genuinely immutable. An external drive at a relative's house satisfies both. A cloud sync folder satisfies neither. Restore one real file from each copy and write the date down.

The failures to check for

Stop looking for Macrium Reflect Free: version 8 was the last free release, its security patches ended on 1 January 2024, and Reflect X replaced the line on 8 October 2024 as a paid subscription. Backup and Restore (Windows 7) has been deprecated since the Windows 10 Creators Update and makes no new images, only restores old ones. File History survives but is reported to fail silently when you enable it after 24H2 and 25H2 updates, a fault Microsoft has not acknowledged.

macOS Tahoe (macOS 26) invalidated a decade of Mac advice. New Time Machine stores must be APFS, so Tahoe refuses to create one on an HFS+ "Mac OS Extended" disk, and Time Capsules can no longer host new backups, though existing stores keep working. Local snapshots sit on the same disk as the originals and are kept up to 24 hours, so they are not a second copy of anything.

Two Backblaze rules bite households. An external drive left disconnected for more than 30 days is treated as permanently deleted and its cloud copy securely removed, with warnings at 14, 21 and 28 days. Computer Backup also refuses network drives, shares and NAS devices, so a NAS needs B2 and a backup tool. And keep your restic or Borg passphrase off the machine being backed up, because a key stored only inside the backup set is not stored.