I have a backup. But can I recover my files?

The folder is called ‘Backup’. Job done?

We have our documents in one folder and a copy in another. Perhaps even on a different drive letter: we work on C: and save the backup on D:. Everything is organised. We can sleep soundly.

Until the day the drive stops working.

If C: and D: are two partitions on the same physical drive, the original and the copy become inaccessible at the same time. Different letters, same drive.

It is a bit like keeping your spare house key inside the house itself. You have two keys, certainly. But when you are locked out, the second one is not much use.

A copy on the same drive can get us out of trouble when we change a document by mistake. It does not protect us against that drive failing. A second physical drive helps in that situation; if it is inside the same computer, it still goes with it if the computer is stolen.

That is why I prefer to follow ‘I have a backup’ with a question: what am I protected against?

I will do it tomorrow. Today is not a good time

It takes too long. We do not have a spare drive. The internet is slow. There is work to finish and we cannot stop now.

The reasons for putting it off are quite convincing, especially while everything works. Then a drive fails, a folder disappears or the laptop is stolen. And everything comes crashing down, figuratively speaking, at least.

You never need backups… until you do. When there are none, ‘I will do it tomorrow’ is no longer much help. Bad luck? That too. But there is a part of this story we can prepare for.

I would start with the files I could not recreate: photographs, personal documents, work and projects. We do not have to solve everything at once to start protecting what matters most.

An external drive helps. Forgotten in a drawer, less so

An external drive lets us keep a separate copy and recover data without relying on the internet. But there are three traps worth avoiding:

• Leaving it connected all the time. A ransomware attack, which encrypts files to demand a ransom, can also affect copies accessible from the computer. After the backup, checking the result and safely ejecting the drive reduces that exposure.
• Keeping it in the laptop bag. If both are stolen together, the problem and the solution disappear at once. Copies kept in the same home also share risks such as fire or flooding.
• Confusing a schedule with a completed backup. A task can exist and have been failing for weeks because there is no space left or the drive is not connected. The date of the last completed backup is what matters.

Buying a drive for backups does not make it back anything up. Unfortunately, that feature still depends on us.

Backup types, without turning this into a whole lesson

We can back up files and folders to recover our data, or create a system image for a more comprehensive recovery of the operating system, applications and included data. If we only protect our documents, we should expect to reinstall Windows and our programs if the drive fails.

Then we choose how to save changes:

Method	What it saves	What recovery requires in the traditional model
Full	All the selected data.	The chosen full backup.
Incremental	Changes since the last full or incremental backup.	The full backup and the required sequence of incrementals.
Differential	Changes since the last full backup.	The full backup and the chosen differential.

Saving only changes can save time and space. In return, recovery depends on the base backups. The application should manage those dependencies and clean-up: manually deleting backup files ‘because they are old’ can break the set.

Microsoft’s documentation describes these three methods. We do not need to memorise the names to get started; we need to know what the tool saves and how it restores it.

What about mirrored drives, such as RAID 1? They help tolerate a drive failure, but they also reflect deletions. Having several drives in a NAS — network-accessible storage — does not automatically create a history or a copy outside the home.

The 3-2-1 rule gives us a starting point

The idea is simple: three copies of the data, including the original, on two types of storage media, with one copy offsite. This is the traditional formulation presented in CISA’s guide to backup options.

The important thing is to prevent the same incident from taking everything. A disconnected copy makes access through the computer harder; a copy elsewhere protects against problems affecting the whole home. These protections complement each other.

We also need earlier versions. If we only discover today that we damaged a document a fortnight ago, yesterday’s copy may already contain the same mistake. Retention is how long we keep those versions.

What if we use the cloud instead of carrying drives around?

This changes the arrangement: we send copies over the internet to remote storage. We can automate the process and keep data outside the home without carrying a drive around.

That is a real advantage. If the laptop disappears, the remote copy does not disappear with it. But we still need to understand what is stored and how to recover it.

Syncing can also sync the blunder

A synced folder keeps files up to date across several devices. We make a change on one and it appears on the other. The problem is that deleting the wrong file can also be a perfectly well-synchronised change.

Some services offer a recycle bin and version history that can save us in that situation. The mistake is assuming that history lasts for ever or covers every file.

Before relying on the cloud, I would check four things: which folders are included, how long versions are kept, how to recover a deleted file and who can delete the backups. The UK’s NCSC discusses these precautions for cloud backups.

Seeing a file in File Explorer does not guarantee it has been downloaded either: it may only be available online. It is worth checking that the backup tool actually includes its contents.

The account and the connection become part of the plan

Enabling multi-factor authentication helps protect the account. Preparing recovery options avoids relying solely on a phone or laptop we might lose. If we encrypt the copies with a key only we hold, we also need to keep it safe.

Then there is time: recovering hundreds of gigabytes over the internet can take hours or more, depending on the connection and the service. A local copy can speed up that recovery; a remote one gives us physical separation. We can use both.

An example: Windows and 200 GB we do not want to lose

Imagine a Windows computer with 200 GB of important documents, photographs and projects. These figures describe an illustrative scenario, not test results.

A starting routine could look like this:

Copy	Routine	What it is for
Daily local	An automatic backup with version history to a second physical drive or local device.	Recovering recent changes or dealing with the main drive failing.
Weekly external	On Sunday, back up to a separate external drive, check the result and disconnect it.	Keeping an isolated copy between runs, including in case of an attack on the computer.
Daily remote	Send the important folders to a backup service with version history.	Recovering data if we lose the computer and the local copies.

This example includes an extra copy beyond the basic 3-2-1 arrangement. Someone getting started can simplify it by using an external drive with a regular routine and a remote copy. The essential thing is to follow the routine and understand its limitations.

To set this up, I would start by selecting the folders, configuring the destinations and schedule in a backup tool, enabling failure alerts and checking the first run. The destination needs room for the data and the history, not just 200 GB of free space. The first full backup may take longer; subsequent ones can save only changes.

What would happen if something went wrong?

• The main drive fails: we restore the latest local copy to a replacement drive. If we only backed up files, we first reinstall the operating system and applications we need.
• We delete a document: we look for a version from before the deletion within the history we have kept.
• The computer and local drives are stolen: we use the remote copy on an available device and recover up to the last completed backup.
• An attack affects the connected copies: the disconnected weekly drive offers another option. In that case, we may lose changes made since Sunday.

The useful backup frequency depends on the incident. Having an accessible daily copy does not mean it will survive the same attack that affected the original.

How much can I lose? How long can I wait?

These two questions have technical names, but the idea is quite practical:

• RPO — Recovery Point Objective: the maximum amount of data, measured in time, that we are prepared to lose. If we can accept losing up to a day’s changes, the target is an RPO of 24 hours.
• RTO — Recovery Time Objective: the target maximum time for making the data or service available again after a disruption. We might set a target of four hours, for example.

With one valid backup a day, a failure just before the next run can cost almost 24 hours of changes. That plan may meet the first objective, provided the backup has finished and survives the incident.

Now imagine we need eight hours to obtain a computer, reinstall what we need and restore the files. The data was backed up, but the four-hour target was not met. We need to revise the plan or accept a more realistic timeframe.

The figures in this example are not predictions for those 200 GB. A recovery test lets us assess the actual time. New Zealand’s NCSC links these objectives to backup frequency, destinations and testing.

Try it before panic sets in

Creating a test document, backing it up, changing it and restoring the earlier version to another folder already teaches us quite a lot. Opening the result confirms whether we have the right contents. We can repeat the exercise with a deleted test file.

There is no need to delete real documents to test a backup. And restoring one file does not prove we can restore a whole computer: a system image needs its own trial, on a test drive or in a test environment, to avoid overwriting data in use.

I would rather discover a configuration mistake on a quiet Tuesday than on a Sunday evening, with work due on Monday.

So, am I protected?

If the only copy is on the same drive, we are still dependent on that drive. If it is on another device, we need to consider the risks they still share. If it is in the cloud, we need to understand the history, access and recovery process.

None of these choices offers absolute protection. We can, however, combine copies that withstand different failures and check that they return the data we need.

The next time we say ‘I have a backup’, it is worth finishing the sentence: I know where it is, how recent it is, and I have checked that I can recover my files.