1 Overview
Local backups are the copies closest to you: an external drive on the desk, a NAS in the closet, a second disk inside the machine. They are fast, cheap, and independent of your internet connection, which makes them the first line of defense when something goes wrong. The problem is not that people fail to create them. The problem is that people create them once, assume they work, and never look again. A backup you have never restored from is a hope, not a safeguard.
This article treats local backups as one part of a complete 3-2-1 setup: three copies of your data, on two different kinds of media, with one copy offsite. The local pieces handle speed and convenience. The offsite piece handles catastrophes that take out your whole location. Testing ties the whole system together, because the only meaningful measure of a backup is whether it can bring your data back when you need it.
The guidance here is deliberately evergreen. Specific drive models, capacities, and prices change constantly, but the principles do not: separate your copies, verify them, encrypt them, and rehearse the restore before disaster forces you to improvise.
2 What you are actually protecting against
It helps to name the threats instead of treating backup as a vague virtue. Accidental deletion is the most common: a wrong keystroke, a dragged folder, an emptied recycle bin. Local backups shine here because recovery is quick and does not depend on a network. File corruption and silent bit rot are slower threats. A file can degrade over months without anyone noticing, which is why keeping multiple restore points across time matters more than keeping one perfect copy.
Hardware failure is the classic case. Drives wear out, controllers die, laptops get dropped, and power surges damage electronics. Ransomware and other malware are a modern twist: an attacker may encrypt your working files and any connected backup drives, then demand payment. That is why at least one copy should be offline or otherwise unreachable from the machine it protects. Theft, fire, flood, and power events are rarer but total, and they are exactly what the offsite leg of 3-2-1 exists to survive.
Finally, there is human error at the administrative level: a backup job that silently stopped running weeks ago, a drive that filled up, a schedule that was never re-enabled after a system change. Monitoring and testing are the only defenses against this quiet failure mode, and they deserve as much attention as the initial setup.
3 Choosing a backup strategy
Start by deciding what you are protecting. A full system image captures the operating system, applications, and settings so you can rebuild a machine quickly. File-level backups capture documents, photos, and project folders and are easier to browse and restore selectively. Many people run both: frequent file-level backups for day-to-day recovery, and a periodic image for bare-metal rebuilds. Match the tool to the job rather than forcing one approach to do everything.
Next, choose your media. External USB drives are inexpensive and simple. A NAS offers shared storage and can hold multiple drives, but it is still a single device in a single room. A second internal drive is convenient but shares power and the operating system with the original, so it is a weak sole backup. Whichever you pick, use media that is separate from the working copy and, ideally, a different technology from your other copies so one failure mode cannot take out both.
Then set a schedule and a retention policy. Daily backups suit active work; weekly backups may suffice for archives. Keep enough restore points to cover the time it would take you to notice a problem, and keep at least one older archive beyond that window. Automate the schedule, but review it periodically, because an unattended job that has quietly failed is worse than no job at all.
4 The 3-2-1 rule in practice
The rule is simple to state: three copies of your data, on two different types of media, with one copy offsite. In practice, the working copy on your computer is copy one. A local backup on an external drive or NAS is copy two. An offsite copy, whether in the cloud or on a drive stored elsewhere, is copy three. The two-media requirement means you should not rely on three identical drives in the same drawer; vary the technology so a single flaw or failure mode does not affect every copy.
Applying it locally means being honest about what counts. A synced folder is not automatically a backup, because deletions and corruption can propagate to every synced device. A snapshot on the same disk is convenient but disappears with the disk. A true local backup lives on separate media and is written in a way that lets you recover earlier versions, not just the latest state. If your only local copy is a mirror of the live data, you have redundancy, not history.
Finally, keep the copies from becoming entangled. Disconnect or power down the local backup drive when it is not in use, or use a device that only accepts writes during the backup window. That separation is what lets copy two survive a ransomware infection or an accidental mass deletion on the working machine, and it is the difference between a real 3-2-1 setup and a comforting diagram.
5 Restore is the real test
A backup that has never been restored is an untested assumption. The only way to know your data is recoverable is to recover it, on purpose, before you need it. Start small: pick a few files, restore them to a scratch folder, and open them to confirm they are intact and current. Then go bigger. Restore a full folder tree, and eventually perform a full system image restore onto spare hardware or a virtual machine. Each step exposes problems that a status light never will.
Schedule these tests rather than waiting for a crisis. A reasonable rhythm is a quick file-level spot check monthly, a broader restore test quarterly, and a full image restore at least once a year or after any major change to your hardware, software, or backup configuration. Record what you tested, when, and what you found. If a restore fails, that is a successful test, because you found the problem while you still had time and options.
Pay attention to the details that break restores: missing encryption keys or passwords, backup software that no longer installs, drives that are not readable, and catalogs that point to files that no longer exist. Store recovery credentials somewhere separate from the backups themselves, and keep a written procedure so anyone who needs to recover data can follow it. Testing is not paranoia. It is the part of backup that turns a copy into a capability.
6 Offsite and encryption
The offsite copy is what saves you when the whole location is lost. Fire, flood, theft, or a prolonged power event can destroy every local drive at once, no matter how many you own. Keep at least one copy in a different building, whether that means a cloud storage target, a drive at a trusted relative's home, or a safe deposit box rotated on a schedule. The distance only needs to be enough that a single event cannot reach both the original and the copy.
Encryption protects that offsite copy, and it protects local drives too. If a backup drive is lost, stolen, or handed to a cloud provider, encryption keeps the contents unreadable without the key. Use strong, well-reviewed encryption, and treat the key or passphrase as carefully as the data itself. A lost key turns an encrypted backup into noise, so store recovery keys in a separate, secure place and confirm during restore testing that the key actually works.
Encryption also has practical limits worth understanding. It does not stop ransomware from encrypting files before they are backed up, and it does not help if the key is stored on the same machine as the backup. Combine encryption with offline or write-restricted copies, and verify that your restore process can decrypt what it needs. Offsite plus encryption plus tested restores is what makes the third copy genuinely useful rather than merely present.
7 Frequently asked questions
How many local backups do I need? At least one local copy on separate media beyond your working data, plus an offsite copy. More copies across more media reduce risk, but the 3-2-1 structure is the baseline. Do not count a synced folder or a same-disk snapshot as your only local backup, because neither provides independent history.
How often should I test restores? Spot-check a few files monthly, run a broader restore quarterly, and do a full image restore at least yearly. Test after any change to hardware, software, or backup settings, because those changes are when silent failures appear. Keep a short written log of each test and its result.
Is cloud storage enough on its own? No. Cloud copies are excellent offsite protection, but they depend on your internet connection and provider account, and a compromised account can expose or delete them. Keep a local copy for fast recovery and use the cloud as the offsite leg, not the whole plan.
What about encryption keys? Store them separately from the backups, in more than one secure place, and confirm during every restore test that they still work. A backup you cannot decrypt is not a backup. Finally, remember that retention matters: keep enough restore points to cover slow corruption and accidental deletion, not just yesterday.