You press the power button and nothing happens. Or something happens, but it’s wrong — a black screen, an endless boot loop, a message about a corrupted drive. For a few seconds you just stare at it, and then the real question hits: what was actually on there? Ten years of photos. Tax documents. The half-finished draft you’ve been meaning to get back to. A client project due tomorrow. If the answer to “where else does a copy of this exist?” is nowhere, you’re not troubleshooting a computer anymore — you’re finding out how much of your life just disappeared.
Most people never get a real backup system in place until after a moment like that. This guide is for getting one in place before it happens, and it’s simpler than it sounds — not because there’s a magic tool that does everything, but because the underlying idea is genuinely easy to understand once someone walks you through it.
Why doesn’t one backup count as being backed up?
This is the part almost everyone gets wrong, usually without realizing it. Plenty of people who’d say “yes, I’m backed up” mean they have one external drive plugged into their computer, or one folder synced to one cloud account. That’s a real improvement over nothing. But a single copy in a single place has a specific, serious weakness: it tends to be exposed to the same risks as the original.
Walk through what can actually go wrong:
- Theft or loss. If your laptop and your backup drive live in the same bag, the same desk drawer, or the same house, whatever takes one can take both.
- Fire or flood. A house fire doesn’t spare the external drive sitting next to the computer. Neither does a burst pipe or a flooded basement.
- Ransomware or malware. This is the one people underestimate the most. Ransomware doesn’t just encrypt the files on your computer — it encrypts everything it can reach, and a backup drive that’s permanently plugged in is reachable. An always-connected backup can get encrypted right alongside the original, at the exact moment you needed it most.
- Hardware failure of the backup itself. Backup drives are still mechanical or electronic devices, and they fail. An unlucky drive failure on your one and only backup means you’re right back to zero, just later than you expected.
None of these are exotic. They’re the ordinary ways computers and the data on them get lost. And a single backup, sitting in the same place or on the same connection as your computer, doesn’t protect against any of them reliably. It protects against exactly one thing well: accidentally deleting a file or having your main drive fail on its own, with nothing else going wrong at the same time. That’s worth having. It’s just not the whole picture.
What does an actual backup strategy look like?
The principle that fixes all of the above at once is simple, and it’s worth understanding the reasoning rather than just memorizing a rule: keep your data in more than one place, with at least one of those places physically separate from the others. People often describe this as having three copies of your data — the original on your computer, plus two backups — with at least one of the two backups stored somewhere off-site.
“Off-site” just means somewhere other than where your computer lives. Cloud storage naturally satisfies this, since it’s stored on servers somewhere else entirely. A drive kept at a family member’s house, in a safe deposit box, or at a second location works too.
The logic behind this is straightforward once you see it laid out:
- One copy protects against nothing except your own certainty that nothing will ever go wrong.
- Two copies in the same place protect against drive failure and accidental deletion, but not against theft, fire, or ransomware — anything that takes out the location takes out both.
- Two copies in different places protect against almost everything, because it’s very unlikely that the same event destroys your computer and something in a different physical location at the same time.
You don’t need a complicated rotation of drives or an enterprise-grade system to benefit from this. You need one backup that lives locally, for fast and easy restores, and one that lives somewhere else, for the scenarios where local backups fail you. That’s the whole structure.
Are local backups (an external drive) still worth having?
Yes — they’re just not sufficient on their own. A local external drive has real advantages: it’s fast to back up to, fast to restore from, and it doesn’t depend on your internet connection. If your main drive fails and you have a recent local backup, getting back up and running can be a matter of hours, not days.
The catch is the same one covered above: a local drive shares your location and, if it’s always connected, shares your exposure to ransomware. There’s a simple habit that closes most of that gap — disconnect the backup drive when you’re not actively using it. A drive that’s only plugged in during the backup itself, and disconnected the rest of the time, can’t be touched by malware that’s encrypting files on your live system, because it simply isn’t there to reach. It also can’t be taken in the same moment as your laptop if it’s stored separately rather than sitting next to it on the desk.
None of this means a local drive is a weak choice. It means treating it as one half of the setup rather than the whole thing.
What about cloud backups — are they enough by themselves?
Cloud storage solves the location problem directly, which is exactly what a local-only setup is missing. Your files exist on servers somewhere else, so a fire, flood, or theft at your location has no effect on that copy. That makes cloud backup genuinely valuable, not just as a convenience but as the off-site half of a resilient setup.
It comes with honest trade-offs, though. Restoring a large amount of data over an internet connection takes time — potentially a lot of it, if you’re pulling down hundreds of gigabytes of photos and files after a drive failure. And most cloud storage with enough space to hold a real backup involves an ongoing subscription cost once you’re past whatever free tier is offered. Neither of these is a reason to skip cloud backup — they’re just realities worth knowing going in, so you’re not surprised by them later.
Used together, local and cloud backups cover each other’s weak points: local gives you a fast, no-internet-required restore for everyday problems, and cloud gives you the off-site protection that a local drive can’t provide on its own.
Should backups be automatic or is doing it manually fine?
In theory, manual backups work. In practice, they’re the backups that don’t happen. Life gets busy, the backup gets postponed “until this weekend,” and the drive failure or the ransomware infection shows up on a Tuesday, two months after the last time anyone actually copied anything over.
Automatic, scheduled backups remove the part of the process that depends on remembering. Once it’s set up — backing up on a schedule, or continuously as files change — it keeps happening whether or not you thought about it that day. This one change, more than any specific tool or drive, is usually what separates a backup system that works when you need it from one that quietly stopped working months ago without anyone noticing.
What actually needs to be backed up?
For most people, the real concern is personal files: photos, documents, videos, anything that can’t be redownloaded or recreated. Backing these up covers the overwhelming majority of what would actually hurt to lose. This is also the simplest thing to back up, since it’s usually a matter of pointing a backup tool at a handful of folders.
There’s a second, more thorough option worth knowing exists: a full system backup, sometimes called a disk image or system image, which captures the entire operating system, installed programs, and settings — not just your files. This lets you restore a computer to exactly the state it was in, programs and all, rather than reinstalling everything from scratch and then copying your files back in. It’s more involved to set up and takes up more storage space, and it’s genuinely useful if reinstalling and reconfiguring everything from zero sounds like a headache you’d rather avoid.
For someone just getting a backup system in place for the first time, backing up personal files is the right place to start. A full system image is worth adding later if you decide the convenience is worth the extra setup.
How do you know a backup will actually work when you need it?
This is the step almost everyone skips, and it’s arguably the most important one. A backup that has never been opened, checked, or restored from isn’t a verified backup — it’s an assumption. Files can fail to copy correctly, a backup job can silently stop running months ago without any error showing up, a cloud sync can quietly exclude a folder you thought was included. None of that becomes visible until the day you actually need to pull a file back out, which is the worst possible moment to discover a problem.
Testing doesn’t need to be elaborate. Periodically — every few months is reasonable — open the backup and confirm you can actually find and open a few files from it. Try restoring one file you don’t urgently need, just to confirm the process works end to end. If you’re relying on a full system image, most backup tools offer some way to verify the image is intact without needing to fully restore it. The point isn’t to prove your backup is flawless. It’s to catch a broken or stalled backup while it’s still an inconvenience to fix, rather than a disaster.
Why is ransomware treated as a special case here?
It’s worth calling out on its own because it breaks the assumption people usually make about backups. Most other risks — theft, fire, hardware failure — threaten either your computer or your backup, but not both at once, unless they’re in the same place. Ransomware is different: it can actively reach out and encrypt anything connected to the infected computer, including a backup drive that’s plugged in at the time.
That means an always-connected local backup, which feels safe because it’s right there and constantly up to date, can be exactly as vulnerable as your main drive the moment ransomware gets in. The backup exists, it’s recent, and it’s useless, because it got encrypted in the same attack.
This is the strongest practical argument for the two habits already covered: keep a backup disconnected when it’s not actively being used, and keep at least one backup somewhere genuinely separate — physically, or on a cloud service that isn’t just a synced folder ransomware can reach and overwrite. Between the two, an unreachable backup is a backup ransomware can’t touch, which is the entire point of having one.
What’s a realistic starting setup if you have nothing backed up right now?
Don’t let the idea of a “proper” multi-tier backup system talk you out of starting. If you currently have zero backups, the single highest-value move is setting up one automatic, off-site backup of your personal files — a cloud backup running on a schedule, not something you have to remember to trigger. That one step alone moves you from having nothing to having something that survives theft, fire, and a dead hard drive, which covers a large share of realistic worst cases.
From there, you can build outward whenever it’s convenient: add a local external drive for faster restores and as a second copy, get in the habit of disconnecting it between backups, and test the setup every few months to confirm it’s actually working. But none of that has to happen on day one. One working automatic backup, started this week, is worth more than a perfect three-copy system you’re still planning to set up someday.
And if the moment has already passed — if the computer won’t start and there’s no backup to fall back on — that’s a different problem with a different fix: recovering deleted photos covers what to do after the fact. This guide is about not needing that guide.
Privacy and backup are two different kinds of protection people conflate — here is the difference, and what actually matters for each.
A backup is only useful if the files inside it are things you can actually find again — naming, not folder structure, is what makes that possible.
The National Cyber Security Centre publishes practical security guidance including backup, at Cyber Aware, with nothing attached to a product.
Frequently asked questions
How often should I back up my computer?
For most personal files, backing up automatically every day, or continuously as files change, is ideal since it minimizes how much work you could lose between backups. If daily isn’t practical for your setup, weekly is still far better than backing up only occasionally or manually whenever you remember.
Do I need both a local and a cloud backup, or is one enough?
One is far better than nothing, but having both is what actually covers the range of real risks. A local backup alone doesn’t protect against fire, theft, or ransomware at your location. A cloud backup alone can be slower to restore from and depends on your internet connection. Together, each one covers what the other misses.
Can ransomware really infect my backup drive too?
Yes, if the drive is connected to the computer when the ransomware runs. Ransomware encrypts files it can reach, and a permanently connected drive is reachable just like your main storage. Disconnecting a backup drive when it’s not actively being used, and keeping at least one backup off-site, are the two most effective protections against this.
Should I back up my entire system or just my personal files?
For most people, backing up personal files — photos, documents, and anything irreplaceable — covers the real concern and is the simplest place to start. A full system image, which captures the entire operating system and all your programs, is a more thorough option worth adding later if you’d rather restore everything at once than reinstall from scratch.
How do I know if my backup is actually working?
Test it periodically rather than assuming. Every few months, open the backup and confirm you can find and open a few recent files, or restore one file you don’t urgently need. A backup that’s never been checked can fail silently for months without anyone noticing until it’s too late.
What’s the single most important thing to fix if I only have one backup right now?
Make sure at least one copy of your data lives somewhere physically separate from your computer, ideally through an automatic cloud backup. A single backup that sits next to your computer or stays permanently connected to it shares almost all the same risks as the original, which defeats much of the purpose of having it.