THE BACKUP JOURNAL · 3-2-1-1-0

Every backup plan, lined up on the same shelf.

Each plan is filed the same way — what it protects, how it is copied, how long you keep it, how fast you can restore, whether a copy lives offsite, and what it tends to cost. Compare plans on one wall instead of trusting a vendor.

Browse the racks

6 entries Backup Software 9 entries Cloud Backup 6 entries Data Recovery 9 entries Local Backup

Backup Software

All Backup Software →

Backup Software Why Your Backups Are Ransomware Bait: The 3-2-1-1-0 Fix StrategyA layered approach combining the 3-2-1 rule (three copies of data, on two different media types, with one copy offsite) plus one immutable or air-gapped copy and zero errors verified through restore testing, often summarized as 3-2-1-1-0. RetentionRetention tiers typically range from 30 days of daily recovery points to 12 months or more of monthly archives, with longer retention for regulated or irreplaceable data and shorter windows for high-churn temporary data. RestoreFull system restores commonly take hours to a day or more depending on data volume, bandwidth, and media speed, while file-level or granular restores can complete in minutes; recovery objectives should be defined per system rather than assumed. OffsiteAt least one copy must reside in a physically separate location from the primary data, such as a secondary data center, a cloud region, or encrypted removable media stored offsite, so a single incident cannot destroy every copy. Ransomware changed the economics of backup. Backup Software Your Backup Software Is Lying to You: RPO and RTO Are the Only Truth StrategyLayered backups: frequent incremental or differential copies plus periodic full images, with at least one immutable or offline copy and regular restore testing. RetentionDaily copies for 30 days, weekly copies for 12 weeks, monthly copies for 12 months, and one annual archive retained for at least 3 years where compliance requires it. RestoreSingle files in minutes; a full server or database typically 2 to 8 hours depending on data volume, bandwidth, and dependency order. OffsiteAt least one encrypted copy in a separate geographic region or offline location, isolated from the primary network and credentials. Backup software reports success, but success is not the same as recoverability. Backup Software Don't Let Ransomware Win: Why Your Backup Software Needs an Offline Copy StrategyFollow the 3-2-1 rule: keep at least three copies of data, on two different media types, with one copy stored offline and immutable so ransomware cannot encrypt or delete it. RetentionKeep daily restore points for at least 30 days, weekly full copies for 90 days, and monthly archives for 12 months, adjusted to match legal and business requirements. RestoreA single file can be restored in minutes; a full server or virtual machine typically takes one to several hours depending on data volume, bandwidth, and hardware. OffsiteAt least one copy must reside offsite or in an isolated, air-gapped location that is not reachable from the production network. Ransomware does not simply encrypt the files on your laptop. Backup Software The Backup Software Myth: Why Your Backups Are Doomed Without an Air Gap StrategyLayered backups combining frequent local snapshots for fast recovery with immutable or offline copies isolated from the primary network, following the 3-2-1 principle. RetentionAt least 30 daily restore points, 12 monthly archives, and one or more annual copies, adjusted to meet legal, contractual, and operational requirements. RestoreMinutes to a few hours for single files and virtual machines from local copies; several hours to a few days for full-site recovery from offsite or air-gapped media. OffsiteAt least one complete copy must reside in a physically separate location or an isolated, network-unreachable environment, with periodic verification of its integrity. Backup software is often sold as the solution to data loss, but software alone cannot protect you from the threats that actually destroy backups. Backup Software Snapshots Aren't Backups: Why You're One Ransomware Attack Away from Disaster StrategyTreat snapshots as a short-term operational recovery layer only, and pair them with independent, versioned backup copies that are written to separate storage and cannot be altered or deleted by the production environment. RetentionSnapshots for hours to a few days; independent backups retained on a daily, weekly, and monthly schedule for at least several weeks to several months, with longer retention for regulated or high-value data. RestoreSnapshots restore in minutes to a few hours; full independent backups typically restore in hours to a day or more depending on data volume, network bandwidth, and whether the restore is local or offsite. OffsiteAt least one immutable or offline copy must be stored in a separate location or trust boundary, isolated from production credentials and networks. Snapshots are one of the most useful tools in modern storage and virtualization, and they are also one of the most commonly misunderstood. Backup Software Snapshots Are Not Backups: Why Veeam and Tape Still Rule StrategyA layered approach: frequent storage snapshots for fast rollback, independent backup software for full image and file-level copies, and periodic tape or offsite disk copies for archival and air-gapped protection. RetentionSnapshots: hours to days. Operational backups: 30–90 days. Long-term tape or offsite copies: 1–7 years or as required by compliance. RestoreSnapshots: minutes. Full VM or database restore from backup: 1–4 hours. Tape restore: hours to days depending on data volume and tape retrieval. OffsiteAt least one copy must be stored offsite or in an immutable cloud repository, physically separated from the primary site, with encryption in transit and at rest. Snapshots are point-in-time copies of a storage volume that allow quick rollback after accidental deletion or logical corruption.

Cloud Backup

All Cloud Backup →

Data Recovery

All Data Recovery →

Data Recovery Why Your Backups Are Not Data Recovery: Test the Restore StrategyLayered backups combining full, incremental, and differential copies, with periodic image or snapshot captures and versioned retention. RetentionKeep multiple restore points: daily copies for a few weeks, weekly copies for a few months, and monthly copies for a year or longer where regulation or value justifies it. RestoreVaries by data volume and method: minutes for small file restores, hours for application or database recovery, and longer for full system rebuilds. OffsiteAt least one copy must be stored in a separate physical or geographic location, isolated from the primary environment. A backup is a copy. Data recovery is the process of turning that copy back into usable data, applications, and services. The gap between the two is where most organizations get surprised. A backup job that reports success only proves that data was written somewhere. It does not prove that the data can be read, that the application can start, that dependencies are present, or that the restore will finish inside the time the business can tolerate. Data Recovery Snapshots vs. Backups: Why Your Recovery Plan Is Probably Broken StrategyUse snapshots as short-term point-in-time rollback for local operational recovery, and independent full or incremental backups copied to separate storage for durable recovery; apply the 3-2-1 rule so at least three copies exist on two media types with one offsite. RetentionSnapshots: hours to a few days, limited by primary storage capacity and change rate. Backups: daily to weekly operational copies for weeks to months, plus monthly or quarterly archives retained for months to years according to business, legal, and compliance needs. RestoreSnapshots: seconds to minutes for a local rollback. Backups: minutes to hours for small data sets; hours to days for large systems, depending on data volume, bandwidth, media, and whether a full restore or granular file recovery is required. OffsiteRequired for backups; at least one copy must be stored in a separate location or trust domain, isolated from the primary site and its credentials, with periodic verification that the offsite copy is readable and restorable. Snapshots and backups are often treated as interchangeable safety nets, but they answer different questions. Data Recovery Stop Treating Snapshots Like Backups: Set Real RPO and RTO StrategySnapshot plus independent backup copies: frequent local snapshots for fast rollback, paired with full and incremental backups written to separate storage and media so a lost array or corrupted snapshot chain does not destroy the only copy. RetentionShort snapshot retention measured in hours to days, with backup retention tiered from daily copies for weeks to monthly or quarterly copies for months or years depending on compliance and recovery needs. RestoreSnapshot rollback in minutes for small in-place recoveries; full backup restores typically range from under an hour for small data sets to many hours or days for large ones, bounded by data volume, bandwidth, and media speed. OffsiteAt least one copy must reside in a separate location or failure domain, either a second site or an isolated cloud or object store, with periodic verification that it is readable and restorable. Snapshots are convenient, fast, and easy to schedule, which is exactly why so many teams quietly let them become the only copy of important data. Data Recovery Snapshots vs. Tape: Which Backup Recovers Best? StrategySnapshots are point-in-time copies kept on or near the primary storage array, often scheduled hourly or daily; tape is a sequential offline medium written by a backup server, usually with a rotating schedule of full and incremental jobs. RetentionSnapshots are commonly retained for hours to a few weeks because they consume primary storage; tape cartridges are retained for months to years and are the usual medium for long-term archival retention. RestoreSnapshot restores are typically minutes because data stays on disk; tape restores range from tens of minutes to many hours or days depending on tape location, cartridge load, and whether a full or incremental set must be replayed. OffsiteSnapshots alone are not offsite unless replicated to a second site or cloud; tape provides offsite protection when cartridges are transported to a secure remote vault or alternate facility. Snapshots and tape are often presented as competing answers to the same question, but they solve different problems. Data Recovery Snapshots Aren't Backups: Real Data Recovery Needs Testing StrategyIndependent, versioned backup copies kept separate from the storage system that hosts snapshots, following the 3-2-1 rule with at least one immutable or offline copy. RetentionKeep daily restore points for at least 30 days, weekly copies for 3 to 12 months, and monthly or annual archives for as long as business, legal, or compliance needs require. RestoreFrom minutes for a single file restored from a local copy to several hours for a full application or server rebuild from offsite media; the achievable time depends on testing and must be measured, not assumed. OffsiteAt least one copy must live in a separate location or trust boundary, such as another region, another provider, or encrypted removable media stored away from the primary site. A snapshot is a point-in-time view of a storage volume, usually created in seconds and kept on the same system as the data it describes. Data Recovery When Your Snapshot Is Not a Backup: A Data Recovery Reality Check StrategyIndependent backup copies separate from snapshots, using full plus incremental or differential backups, with immutable or offline copies and periodic restore testing. RetentionKeep daily backups for 30 days, weekly backups for 12 weeks, monthly backups for 12 months, and at least one annual copy for 3 years, adjusted to business and legal needs. RestoreTypical restore time ranges from 30 minutes for a single file to 4-24 hours for a full server or application, depending on data size, bandwidth, and recovery method. OffsiteAt least one copy must be stored offsite or in a separate cloud region or account, isolated from the primary environment and not reachable with production credentials. Snapshots are often described as backups, but they are not the same thing.

Local Backup

All Local Backup →

Local Backup Your External Drive Isn't a Backup. Here's What Actually Works Against Ransomware StrategyA layered backup approach: at least three copies of data, on two different media types, with one copy kept offsite and offline or immutable where possible. RetentionKeep multiple historical versions, such as daily for a week, weekly for a month, and monthly for a year, depending on data change rate and storage capacity. RestoreVaries by data volume and method; a full restore from a local external drive can take hours, while a cloud or offsite restore may take days over a network. OffsiteRequired: at least one copy must be stored in a separate physical location or a cloud service to survive local disasters and theft. Many people treat an external drive as a complete backup solution. Local Backup Local Backups: Stop Trusting and Start Testing Your 3-2-1 Setup StrategyA layered local-first approach: one primary working copy, one local backup on separate media, and one offsite copy, combined with scheduled verification and periodic full restore tests. RetentionKeep several recent daily or weekly restore points plus at least one monthly or quarterly archive; retain the archive long enough to cover accidental deletion, ransomware dwell time, and slow-to-notice corruption. RestoreA single file or folder typically restores in minutes; a full system image restore commonly takes one to several hours depending on data volume and drive speed. OffsiteMandatory. At least one copy must live in a different physical location or a trusted cloud target so a fire, flood, theft, or site-wide outage cannot destroy every copy at once. Local backups are the copies closest to you: an external drive on the desk, a NAS in the closet, a second disk inside the machine. Local Backup Your Local Backup Is a Time Bomb: Fix It Before Ransomware Does StrategyA layered approach that pairs fast local backups for quick recovery with immutable or offline copies and an encrypted offsite copy, following the 3-2-1 rule: three copies of data, on two different media types, with one copy kept offsite. RetentionKeep daily restore points for at least two to four weeks, weekly copies for one to three months, and monthly or quarterly archives for six to twelve months or longer where compliance or slow-changing data requires it. RestoreLocal restores of files or folders typically take minutes to a few hours; full bare-metal or server rebuilds from local media usually take several hours, while offsite restores depend on bandwidth and can take a day or more. OffsiteAt least one complete copy must reside offsite, either in a cloud or managed storage service or on rotated media stored at a separate physical location, isolated from the primary network. A local backup feels like the safest thing you can do. Local Backup Why Your Local Backup Is a Lie Without an Air Gap StrategyMaintain at least one local backup copy for fast recovery, then isolate it behind an air gap so it is not reachable from the primary network or credentials, and pair it with an independent offsite copy under the 3-2-1 rule. RetentionKeep daily local restore points for roughly two to four weeks, weekly full copies for one to three months, and monthly or quarterly archives for six to twelve months or longer where compliance or recovery objectives require it. RestoreLocal restores from an air-gapped copy typically range from minutes for individual files to a few hours for full systems, depending on data volume, media speed, and whether the target hardware is already prepared. OffsiteRequired. At least one copy must live offsite or in a separate trust domain, because an air gap protects against remote attacks but not against fire, flood, theft, or site-wide loss. A local backup is any copy of your data that lives on or near the system it protects. Local Backup Local Backup Isn't Dead—It's Your Last Line of Defense StrategyFollow the 3-2-1 rule: keep at least three copies of data, store them on two different media types, and place one copy offsite. Local backup supplies the fast, high-bandwidth copy for day-to-day recovery; the offsite copy covers site-wide loss. RetentionRetain daily restore points for at least 30 days, weekly full backups for 3 to 6 months, and monthly archives for 12 months or longer where compliance or long-term reference requires it. RestoreA local restore typically completes in minutes to a few hours depending on data volume and media speed, compared with hours to days for a download or shipped-media recovery from offsite. OffsiteYes. Local backup alone fails the 3-2-1 rule; at least one encrypted copy must live in a separate geographic location, whether cloud storage, a remote office, or rotated media stored offsite. Local backup is the practice of copying important data to a storage target that sits physically near the systems it protects. Local Backup Local Backups Are Not Dead: Make Them Your First Line of Defense StrategyScheduled full and incremental image or file-level copies written to a local external drive or network-attached storage device, with periodic restore verification. RetentionKeep daily local versions for at least seven to fourteen days, plus weekly and monthly restore points for several months, pruned on a rolling schedule. RestoreMinutes to a few hours for file-level recovery; a few hours for a full system image, depending on data volume and storage speed. OffsiteRequired. A local copy alone does not survive fire, flood, theft, or ransomware that reaches attached storage; pair it with at least one offsite or cloud copy. Local backups have been declared obsolete so many times that the obituary has become a genre. Local Backup Local Backups Aren't Dead—But Yours Are Probably Broken StrategyMaintain multiple local backup copies on separate media or devices, using versioned backups with regular schedules and automated verification, while complementing with offsite copies for full protection. RetentionRetain local backups for at least 30 days, with longer retention for critical data or compliance needs; use a rolling window to balance storage capacity and recovery point objectives. RestoreTypical restore time ranges from minutes for small file sets to several hours for large datasets or full system images, depending on data volume, media speed, and verification steps. OffsiteOffsite backup is essential; local backups alone cannot survive site-wide disasters. Maintain at least one offsite copy, either physical or cloud-based, updated regularly. Local backups remain a cornerstone of data protection, offering fast restores and independence from internet connectivity. Local Backup Local Backup: The Unsexy Habit That Saves Your Business StrategyAutomated local backups to a dedicated on-premises target such as an external drive, network-attached storage, or local backup appliance, using scheduled full plus incremental or differential jobs, with periodic integrity checks. RetentionKeep daily restore points for at least two to four weeks, weekly restore points for two to three months, and monthly restore points for six to twelve months, adjusted to fit legal, contractual, and storage limits. RestoreSingle files and folders typically restore in minutes; a full machine rebuild from local media usually takes one to several hours depending on data volume, disk speed, and whether bare-metal recovery is practiced. OffsiteRequired. Local backup alone does not satisfy the 3-2-1 rule; at least one copy must live offsite or in immutable cloud or remote storage to survive fire, flood, theft, ransomware, or site-wide loss. Local backup is the least glamorous part of a data protection plan, and it is often the one that actually saves a business. Local Backup Your Local Backup Is Not a Backup: A Field Report on the 3-2-1-1-0 Rule StrategyThe 3-2-1-1-0 rule: at least 3 copies of data, on 2 different media types, with 1 copy offsite, 1 copy offline or immutable, and 0 errors verified by automated backup validation. RetentionRetention varies by data type and compliance needs; a common approach is daily backups for 30 days, monthly backups for 12 months, and yearly backups for 7 years. RestoreTypical restore time ranges from minutes for small file recovery to hours or days for full system restoration, depending on data volume, backup method, and infrastructure speed. OffsiteAt least one copy must be stored in a geographically separate location, either physical media transported offsite or replicated to a cloud or remote data center. The 3-2-1-1-0 rule is a modern evolution of the classic 3-2-1 backup strategy, designed to address today's threats like ransomware and insider attacks.