Backup 3-2-1 and 3-2-1-1-0: protecting data from ransomware

One of the first things modern ransomware does when it lands on a system is run vssadmin delete shadows /all /quiet — a command that silently wipes every Windows restore point. Then, before encrypting production data, the malware maps backup servers on the network and destroys those too. If your backup was connected to the same network when the attack fired, it went down with everything else. That's exactly where the 3-2-1 rule comes in — and where it needs to evolve.

What is the 3-2-1 backup rule?

What does the 3-2-1 rule mean?

The 3-2-1 rule says to keep 3 copies of your data, on 2 different media types, with 1 copy stored offsite. It's a standard created decades ago in professional photography and later adopted by the IT industry as the minimum acceptable level of protection.

In practice: your file exists on the laptop (copy 1), on an external drive (copy 2, different medium) and on a cloud service such as Google Drive or Backblaze (copy 3, offsite). If the laptop's drive fails, you still have two copies. If the office burns down, the cloud copy survives.

For decades of conventional threats — hardware failure, theft, fire — 3-2-1 worked well. The problem is that modern ransomware was built specifically to break it.

Why 3-2-1 isn't enough against modern ransomware

Ransomware groups like Clop, BlackCat and LockBit don't trigger encryption on day one of access. They spend days or weeks inside the network doing reconnaissance: identifying backup servers (Veeam, Commvault, Windows Server Backup), deleting shadow copies and corrupting repositories before the victim notices anything at all.

According to the Veeam Data Protection Trends Report 2025, 93% of ransomware attacks included an active attempt to compromise backup repositories. Anyone without an immutable or network-disconnected copy was left with no recovery option short of paying the ransom.

There's another neglected risk: Google Drive, OneDrive and Dropbox in automatic sync mode are not backups — they're mirrors. When ransomware encrypts your local files, sync propagates that encryption to the cloud within minutes. You may be "backing up" the disaster in real time.

To understand what happens after an attack fires and how to contain the damage, see the post on how to protect yourself from ransomware and what to do if you're infected.

The evolution: the 3-2-1-1-0 rule

The updated version of the strategy adds two digits that close the gaps modern ransomware created:

• 3 total copies of the data
• 2 different storage media or technologies
• 1 offsite copy (away from the primary location)
• 1 immutable or offline (air-gapped) copy
• 0 errors verified in restore testing

The "1 immutable" is the piece that changes everything. An immutable copy is one that no process — human or malware — can alter or delete once written. It can be:

• An external drive physically disconnected from the network after each backup (a simple air gap)
• A magnetic tape stored offline
• A cloud bucket with a WORM (Write Once, Read Many) policy or Object Lock enabled

The "0 errors" is the most ignored item: silently corrupted backups are common. The zero means every copy has to have been tested and successfully restored — not merely written.

How to implement it in practice

For home use

1. Local copy: an external drive with a weekly backup using Windows Backup (built in), Time Machine on macOS or rsync on Linux. Zero cost beyond the hardware.
2. Second medium: a high-capacity flash drive or SD card kept separate, updated monthly. It serves as an additional copy of critical files.
3. Offsite/cloud: Backblaze Personal Backup (unlimited storage for under $10/month) or Google One with versioning configured for at least 30 days. With 30 days of history, you can restore the version from before the attack even if your files were encrypted and synced.
4. Air gap: the external drive already works as an air gap when you disconnect it after each backup. A flash drive permanently plugged into the USB port is not an air gap — it's a local copy exposed to the same network.

For small businesses

A NAS such as a Synology or QNAP centralizes local copies with automatic scheduling and support for immutable snapshots. Combine that with cloud replication (Synology C2, Wasabi or Backblaze B2) and you've covered the full 3-2-1. For the "1 immutable", configure the destination bucket with Object Lock in Compliance mode — not even the administrator can delete before the set retention period, which stops compromised credentials from destroying the backups.

Free tools that do the job

• Windows: the built-in Robocopy for incremental copies; Veeam Agent for Windows Free for full backups with bare-metal restore
• Linux/macOS: rsync with --delete and --backup; BorgBackup with built-in deduplication and encryption
• Cross-platform: Duplicati — encrypted, open source, supports Backblaze, Google Drive, OneDrive and S3

The restore test: the step nobody does

Schedule a test restore every quarter. It doesn't have to be a full recovery: pick three random files from the backup, restore them to a different location and check that they open correctly. If the process fails or the files are corrupted, you find out now — not during the incident.

The "0 errors" in the 3-2-1-1-0 rule only exists if you test. An untested backup is an assumption, not protection.

Start with what you have

Implementing the full 3-2-1-1-0 may sound intimidating, but the essentials fit in two steps: set up an automatic cloud copy with version history, and buy an external drive that you disconnect from the network after every use. That already covers 80% of data-loss scenarios — hardware failure, accidents and common ransomware variants that lack the sophistication to wait weeks before firing.

For a broader look at how to reduce your attack surface beyond backups, the Guide to OPSEC and Digital Privacy 2026 covers everything from password management to choosing a VPN. And if you use Windows, the 10 Windows 11 security settings include Controlled Folder Access — which blocks ransomware from writing to protected folders before backup ever enters the picture.