3-2-1 Backup Strategy for 2026: Protect Photos & Files

Most people who lose important files do not lose them to a dramatic hard drive explosion. They lose them to a stolen laptop, a ransomware email that opened on a Tuesday afternoon, a sync client that quietly propagated a deletion across every device, or a phone that fell into a lake in Goa during a holiday. The common thread is that the only copy existed in one place, and that place failed.

The 3-2-1 backup strategy is the oldest practical answer to this problem, and it has survived for good reason. The rule is simple: keep three copies of your data, on two different types of storage, with one copy stored off-site. In 2026, the rule still holds, but the threats have shifted. Ransomware now targets backup repositories directly, cloud sync can spread corruption in seconds, and a surprising share of people who believe they have backups have never once tested a restore. A widely cited industry survey from recent years found that a large portion of organizations that experienced data loss had backups that failed when they were needed most, usually because nobody had verified them.

This article applies the 3-2-1 rule specifically to three categories of data most people care about: photos, documents, and work files. Each has different sizes, different change rates, and different recovery priorities. You will get a worked example with real numbers, a comparison of storage options, a numbered setup walkthrough, and a restore-test routine you can run in under an hour a month. I have used this exact setup across my own laptop, a home NAS, and a cloud account for the better part of three years, and the places where it nearly failed are the places I will point out.

Key Takeaways

The 3-2-1 rule means three copies, two media types, one off-site copy. Sync is not backup.

Photos are your largest and most irreplaceable data, so they need the most careful versioning.

Documents change often and small, so frequent incremental backups matter more than raw capacity.

Work files need a backup that survives ransomware, which means versioned or immutable copies.

An untested backup is a hope, not a backup. Run a restore test every month.

Budget roughly 1.5 to 2 times your current data size in total storage for a healthy setup.

What the 3-2-1 Backup Strategy Actually Means

The 3-2-1 backup strategy is a data protection principle that requires three total copies of any important file: the original on your primary device and two backups. Those backups must live on two different storage media, such as an internal drive and an external drive, or a local drive and a cloud service. And at least one of those backups must be stored off-site, meaning physically or logically separated from your home or office so that fire, theft, or a single compromised network cannot wipe out everything at once.

The rule was popularized by photographer Peter Krogh in his book The DAM Book, and it has been adapted for consumers ever since. The underlying logic is probability. Two independent copies on different media reduce the chance that a single failure takes out your data. One off-site copy protects against correlated disasters that hit everything in one location.

Why Sync Is Not Backup

Dropbox, OneDrive, Google Drive, and iCloud are sync services, and sync and backup solve different problems. Sync mirrors changes across devices, which is excellent for access but terrible for recovery. If you accidentally delete a folder or ransomware encrypts files, the sync client faithfully copies the damage to every connected device and the cloud. Some services offer version history or a recycle bin, but retention windows are often 30 days, and they do not capture the full system state.

A true backup keeps point-in-time snapshots or versions that you can restore from, even after the source has been corrupted. When people say they "have backups in the cloud," they usually mean they have sync. Check which one you actually have.

Applying 3-2-1 to Your Photos

Photos are the hardest category to protect because they are large, they accumulate forever, and they are irreplaceable. A wedding, a child's first year, or a trip you will never repeat cannot be re-downloaded. They also tend to live in several places at once: a phone, a laptop, a camera's memory card, and a social or cloud library.

A Worked Example: The 1.2 TB Photo Library

Say you have 62,000 photos and videos totaling 1.2 TB, spread across an iPhone (256 GB, about 180 GB of photos), a MacBook (512 GB, about 300 GB of photos from an older library), and an old external drive from 2019 holding roughly 700 GB of camera card dumps. Your starting position is three copies scattered across three devices, none of them off-site, and none of them verified.

Consolidate first. Pick a single master library. Use your photo app's import feature to bring the MacBook library and the external drive contents into one place, then remove duplicates. Duplicate removal often saves 15 to 30 percent of space in libraries built from card dumps.
Create the primary copy. Your master library on the laptop is copy one, on internal SSD.
Create the second copy on different media. Attach a 2 TB external SSD or a home NAS with RAID 1 mirroring. Copy the full library there with a tool like Time Machine (macOS) or a scheduled robocopy job (Windows). This is copy two, on a second medium.
Create the off-site copy. Upload to cloud storage with versioning, or rotate an encrypted drive to a relative's house or a bank safe deposit box every quarter. For 1.2 TB, cloud archival tiers often cost in the range of a few dollars per month, while a 2 TB drive is a one-time purchase.
Keep the phone copy as a convenience, not a backup. Your iPhone photos are protected only once they flow into the master library, so verify that sync-to-Mac or sync-to-PC is actually working weekly.

After this process, you have three copies of every photo, two media types, and one off-site location. The total storage footprint is about 3.6 TB for 1.2 TB of data, which is roughly three times the original. That number is worth planning around, because it is the honest cost of protection.

Photo-Specific Gotchas

Metadata matters. Some cloud uploaders strip EXIF data or recompress images. Use a tool or service that preserves originals byte-for-byte.
RAW files multiply storage. A single photographer shooting 2,000 RAW images a month at about 40 MB each adds 80 GB monthly. Budget for it.
Shared albums are not backups. A shared album can be deleted by a family member or lost when an account is suspended.

Applying 3-2-1 to Your Documents

Documents are small in aggregate but change constantly. A typical knowledge worker might edit 40 to 80 files a day, and the most dangerous failure is not total loss but silent overwrite: you save a bad version over a good one, and the backup faithfully copies the bad version too. That is why document backups need version history more than raw capacity.

A Worked Example: 47 Passwords, 12 Services, and One Shared Folder

Consider a freelance consultant who keeps about 14 GB of documents: contracts, invoices, client proposals, tax records, and a password vault export. Their documents live in a mix of places: a local Documents folder, a Google Drive folder synced to a laptop, and a few shared Word files emailed back and forth with clients. They have 47 saved logins across 12 services, and the vault export is itself a critical document.

Centralize the working folder. Move everything into one root folder, for example ~/Work, and stop saving to scattered locations. Centralization makes the backup scope obvious.
Copy one is the live folder.
Copy two is an incremental backup to an external drive, run nightly with a tool that keeps at least 30 days of versions. Restic, Duplicati, or the built-in file history on Windows all do this well.
Copy three is encrypted off-site. Send an encrypted backup to cloud object storage every night. Because the files are small, the upload usually completes in under 10 minutes on a typical residential connection.
Protect the vault export separately. Store the password manager's encrypted export on a USB stick kept somewhere physically safe, and check that you can unlock it before you need it.

The consultant's 14 GB becomes roughly 30 GB of total protected storage once you account for 30 days of version history on incremental backups. That is a far more practical footprint than the photo library, and it shows why document protection is usually cheap to do well.

Common Document Mistakes

Relying on a single version. Overwrites are the most common data loss in office work.
Forgetting email attachments. Save important attachments into the working folder rather than leaving them in your inbox.
Ignoring encryption on off-site copies. Documents with tax IDs and contracts should never be uploaded in plain text.

Applying 3-2-1 to Work Files and Code

Work files are where ransomware does its most expensive damage. A single compromised laptop with mapped network drives can encrypt a shared project folder in minutes, and if your backup is also mounted and writable from that laptop, the attacker encrypts the backup too. The defense is immutability: at least one backup copy must be unwritable from the machines you use day to day.

This also applies to developers. A git repository on a laptop is a copy, but unpushed branches, local stashes, and untracked config files are not. Your 3-2-1 plan for code should include a remote push to a second host and a periodic archive of anything not committed.

Choosing Storage: A Comparison

The right second and third copies depend on your data size, budget, and tolerance for setup. The table below compares five common options on criteria that matter for the 3-2-1 rule.

Option	Typical cost (1 TB, per year)	Off-site?	Ransomware resistance	Setup effort	Restore speed
External SSD or HDD	One-time, roughly $60 to $120	No (unless rotated off-site)	Good if disconnected between runs	Low	Fast
Home NAS (RAID 1)	One-time, roughly $300 to $500 plus drives	No	Moderate, depends on snapshots	High	Fast on LAN
Consumer cloud sync (OneDrive, Google Drive)	Roughly $70 to $100	Yes	Poor, because sync propagates changes	Very low	Fast for recent files
Cloud backup with versioning or object lock	Roughly $50 to $150, varies by provider and tier	Yes	Strong if immutability is enabled	Medium	Slower Cover image: 3-2-1 backup 01 by Olaf Pichler, licensed under BY-SA 4.0 via Openverse.