The 3-2-1 Backup Strategy: Never Lose Important Files Again

Three copies, two different media, one off-site. It's the backup rule IT professionals trust — and the difference between a bad day and a catastrophe. Here's how to actually build it.

Why one copy isn't a backup

Data is lost a thousand ways: a dropped laptop, a failed SSD, an accidental delete, ransomware, a flooded apartment, a theft, a buggy sync that overwrites your good copy with garbage. The question isn't if you'll lose data — it's when.

A single copy of a file is one event away from being gone forever. Even two copies in the same place isn't enough, because a single fire, theft, or ransomware infection takes both. The 3-2-1 rule exists because real-world failures are correlated.

The 3-2-1 rule explained

Three numbers, three principles:

• 3 copies of your data. The working copy plus two backups. If any single one fails, you still have two left.
• 2 different media or types. Don't put both backups on identical hardware that could fail the same way. SSD plus external HDD, or local disk plus cloud.
• 1 off-site copy. One backup that survives if your home or office burns down. This is where encrypted cloud storage shines.

The genius of the rule is that no realistic single event can take out all three layers at once.

Building each layer

Layer 1 — the live working copy. The files you actually use, on your laptop or desktop. This isn't a backup; it's the original. Don't confuse "I have it on my computer" with "I have a backup."

Layer 2 — local backup. An external drive plugged in once a week, or a NAS on your network. Use Time Machine (macOS), File History (Windows), or rsync / restic (Linux). This is the layer you restore from when you accidentally delete something — fast, no internet needed.

Layer 3 — off-site, encrypted. A cloud backup that survives your house. Because you don't fully control the provider, this layer should be encrypted on your end before it ever leaves your machine. LifetimeCloud is built for exactly this — a one-time-paid off-site vault that doesn't bill you every month and can't read your files.

Automating the off-site copy

Manual backups don't get done. Automate them. With rclone and your LifetimeCloud account, a single cron entry handles the off-site layer:

# /etc/cron.d/lifetime-backup
# Sync ~/Documents every night at 02:00
0 2 * * * fabio rclone sync \
  /home/fabio/Documents \
  lifetime:Backup/$(date +\%Y-\%m) \
  --log-file=/var/log/lifetime-backup.log

The $(date +%Y-%m) trick creates a fresh folder each month, which gives you a coarse version history without needing snapshots. For finer-grained versioning, look at restic with a LifetimeCloud rclone remote as the repository.

Testing your backup actually works

An untested backup is a Schrödinger's backup — until you try to restore, you don't know if it's alive. Most backup failures are silent: the script kept running, no errors logged, but the files were never actually copied (wrong path, permission issue, full disk).

Set a recurring reminder — quarterly is fine — to do a restore drill:

1. Pick a random file from layer 2.
2. Restore it to a scratch directory.
3. Verify it opens and matches expectations.
4. Do the same with a file from layer 3.

The first time you do this, you will probably find at least one thing wrong. Better now than the day you actually need it.