1 Overview
Many people treat an external drive as a complete backup solution. They plug it in, copy important files, and feel safe. But an external drive is only one copy of your data, and it often sits right next to the computer it is meant to protect. If ransomware encrypts your computer, it can also encrypt the connected external drive. If a fire, flood, or theft occurs, both the computer and the drive can be lost together. An external drive is a useful component, but it is not a backup strategy on its own.
A real backup strategy accounts for multiple failure modes, including ransomware, hardware failure, human error, and physical disasters. It requires more than one copy, more than one type of storage, and at least one copy that is not directly accessible from your main system. This article explains what an external drive does well, where it falls short, and how to build a layered approach that actually works against ransomware and other threats. The goal is not to sell a product but to teach the principles of data protection that apply to any tool you choose.
2 What you are actually protecting against
Ransomware is a type of malicious software that encrypts your files and demands payment for the decryption key. Modern ransomware often seeks out connected drives, including external USB drives and network shares, to maximize damage. If your only backup is an external drive that is plugged in during the attack, it can be encrypted too. Even if the ransomware does not target the drive directly, it may spread through mapped network drives or scheduled tasks that run while the drive is connected. The result is that you lose both your original data and your backup.
Beyond ransomware, you face hardware failures, accidental deletion, software corruption, and physical disasters. A hard drive can fail without warning. A user can overwrite a file or delete a folder by mistake. A power surge can damage electronics. A fire or flood can destroy everything in a room. An external drive left in the same location as your computer does not protect against these events. To be effective, a backup must be isolated from the primary system and stored in a way that prevents a single event from destroying all copies.
3 Choosing a backup strategy
A sound backup strategy begins with deciding what data matters and how often it changes. Not all files need the same protection. Documents, financial records, and irreplaceable photos may require frequent backups, while operating system files can often be reinstalled. Once you identify critical data, you can choose a backup method that matches your recovery needs. The two key metrics are recovery point objective, or RPO, and recovery time objective, or RTO. RPO defines how much data you can afford to lose, measured in time. RTO defines how quickly you need to restore operations after a loss.
For example, if you can tolerate losing a day's work, a daily backup may suffice. If you cannot lose more than an hour, you need more frequent backups. Similarly, if you need to be back up and running within a few hours, you need a restore process that is fast and tested. Your strategy should also include multiple copies. A common approach is to keep a local copy for quick restores and an offsite copy for disaster recovery. The local copy can be on an external drive, but it should be disconnected or powered off when not in use to reduce ransomware risk. The offsite copy can be in the cloud or at another physical location.
4 The 3-2-1 rule in practice
The 3-2-1 rule is a simple guideline: keep at least three copies of your data, on two different types of media, with one copy offsite. The three copies include the original data and at least two backups. The two media types ensure that a failure in one technology does not affect all copies. For example, you might have your original files on an internal drive, a local backup on an external hard drive, and an offsite backup in cloud storage. The offsite copy protects against physical disasters and theft.
In practice, you can adapt the rule to your needs. If you have a small amount of critical data, you might use an external drive for local backup and a cloud service for offsite. If you have large data sets, you might use two external drives, one kept at home and one stored at a trusted location, plus a cloud copy for the most important files. The key is to avoid relying on a single device or location. For ransomware protection, at least one copy should be offline or immutable. Offline means the drive is disconnected when not in use. Immutable means the backup cannot be altered or deleted for a set period, even if an attacker gains access. Many cloud services offer immutability or versioning features that help with this.
5 Restore is the real test
A backup is only as good as its ability to restore data when you need it. Many people create backups but never test them until disaster strikes. That is when they discover that the backup is incomplete, corrupted, or impossible to restore quickly. To avoid this, you must regularly test your restore process. Start by restoring a single file or folder to a temporary location. Verify that the file opens and contains the expected data. Then, if possible, test a full restore to a spare drive or virtual machine. This will reveal how long the process takes and whether you have all the necessary software, licenses, and instructions.
Stress testing restores also helps you refine your RTO. If a full restore takes days but your business can only tolerate hours of downtime, you need a faster method, such as keeping a local image or using a cloud service with rapid recovery options. Testing should be done at least once per quarter, or more often if your data changes frequently. Document the steps and keep them with your backup media. Remember that a backup that cannot be restored is not a backup. It is just a copy of data that gives false confidence.
6 Offsite and encryption
Offsite storage is essential for surviving events that destroy your primary location. This could be a cloud service, a safe deposit box, or a friend's house. The offsite copy should be updated regularly, but not necessarily in real time. For ransomware protection, an offsite copy that is not continuously connected to your network is safer. Some cloud services allow you to upload backups on a schedule and then disconnect, reducing the window of exposure. If you use physical media, rotate drives between locations and keep one offline.
Encryption is critical for offsite backups, especially if they are stored in the cloud or transported. Encryption ensures that even if someone gains access to your backup media or cloud account, they cannot read your data without the encryption key. Use strong, unique passwords and enable two-factor authentication where available. For local backups, encryption protects against theft of the drive. For cloud backups, encryption should happen before the data leaves your device, so the cloud provider cannot read it. Keep your encryption keys in a safe place, separate from the backup. If you lose the key, you lose the data. Always test that you can decrypt and restore your backups.
7 Frequently asked questions
Can I use an external drive as my only backup? No. An external drive is a single copy that is vulnerable to ransomware, theft, and physical damage. It should be part of a larger strategy that includes multiple copies and an offsite location. If you use an external drive, disconnect it after backups and store it separately from your computer.
How often should I back up? The frequency depends on how much data you can afford to lose. If you create new files daily, back up daily. If you can tolerate losing a week's work, weekly backups may be enough. For critical systems, consider continuous or hourly backups. Remember that ransomware can encrypt files within minutes, so more frequent backups reduce potential loss.
What is the difference between RPO and RTO? RPO, or recovery point objective, is the maximum amount of data loss you can accept, measured in time. RTO, or recovery time objective, is the maximum time you can tolerate being down. Both should guide your backup and restore planning.
Do I need to encrypt my backups? Yes, especially for offsite copies. Encryption protects your data if the backup media is lost or stolen. Use strong encryption and keep your keys safe.
How do I test my backups? Restore a few files to a temporary location and verify they open correctly. Periodically perform a full restore to a spare drive or virtual machine to measure restore time and identify issues. Testing ensures your backups are reliable when you need them most.