Data Recovery · October 23, 2026 · ComputerKing Team

Hong Kong Backup Strategy Guide: The 3-2-1 Rule Done Properly — Time Machine, Windows, Cloud and Offline Drives

A copy is not a backup. Real backup means 3 copies, 2 media, 1 offsite: sync is not backup, RAID is not backup, and backup drives should not stay plugged in.

Key Summary

• The golden rule of backup is 3-2-1: keep 3 copies of important data, on 2 different media, with 1 copy offsite. A single copy, wherever it lives, is not a backup.
• Sync is not backup: cloud sync mirrors your files, so accidental deletion and ransomware encryption get synced to the cloud too. A real backup needs version history, plus at least one copy that is not synced in real time.
• RAID is not backup: RAID only protects against a single drive failure. It does not protect against accidental deletion, fire, theft or ransomware, and a NAS needs its own offsite backup too.
• The most reliable starting combination is automatic local backup (Time Machine on Mac, File History or Windows Backup on Windows) + one cloud copy offsite + one offline drive that is plugged in once a week and unplugged straight after backing up.
• "Backup successful" does not mean "restorable": actually test-restoring one or two files at least once a month. A backup that has never been test-restored is only a backup you *think* you have.
• Prices: this article does not estimate any cloud subscription or drive price. Always go by the supplier's or shop's published prices, and get an individual quote for checks and repairs.

Introduction

Has this happened to you? Your computer suddenly will not boot, or you delete the wrong folder, and only then do you ask yourself: did I actually have a backup? Most people's first answer is yes: they copied files to another folder, synced them to the cloud, or have a NAS running RAID at home. But think again — any one of those three may not be a real backup at all.

The cruel thing about backups is this: before something goes wrong, you never know whether your backup works; after something goes wrong and you discover it does not, it is already too late. This guide uses one rule you can remember for life — 3-2-1 — to show you how to tell a real backup from a fake one, how to get started with the built-in tools on Mac and Windows, how cloud and offline drives should divide the work, how often to back up, and the five most common mistakes. No real customer cases are used here; everything is general practice. No prices are estimated; get an individual quote for anything that costs money.

1. The Problem: Why So Many People Think They Have a Backup When They Do Not

Backup failures usually do not come from laziness. They come from three misunderstandings, each of which sounds perfectly reasonable, and each of which is a trap.

The first misunderstanding is "copying it somewhere else counts as a backup". Copying another folder onto the same drive means one dead drive kills both folders. Copying to another partition on the same machine is the same story. What matters for a backup is not how many folders you have, but how many independent carriers you have.

The second misunderstanding is "syncing to the cloud counts as a backup". A sync service is designed to show you the same latest files on every device, so it faithfully syncs every change — including accidental deletion, and including the encrypted versions produced by ransomware. Delete a file on your computer and the cloud deletes it too. Get hit by ransomware and the encrypted files get uploaded to the cloud as well. Your "backup" then contains a pile of files you cannot open.

The third misunderstanding is "a NAS with RAID means I do not need a backup". RAID is designed for fault tolerance: if one drive fails, the array keeps running. But accidental deletion, a fire or flood at home, someone stealing the whole NAS, or ransomware encrypting the whole array — RAID protects against none of those. A NAS is very convenient central storage, but it is not itself a backup, and it still needs an offsite copy.

So the real question is not "do you have a copy?" but "do your copies each protect against a different disaster?" And 3-2-1 is the framework for answering that question.

2. Telling Them Apart: 3-2-1, Where Each Number Guards Against a Different Disaster

3-2-1 is simple. Just remember three numbers:

The three copies each have a job: the first is the original you use every day; the second is a local backup, guarding against accidental deletion or a sudden machine failure, and it is the fastest to restore from; the third is an offsite backup, guarding against the whole premises being affected. Miss any one of them and you have a gap. For example, two copies both kept at home are both lost in a house fire. Three copies that are all synced in real time can all be encrypted by ransomware in one go — which is the same as having none.

There is also a newer variant called 3-2-1-1: on top of 3-2-1, add one more "1" — one copy that is completely isolated and normally disconnected, such as an external drive that is plugged in once a week and unplugged straight after backing up. That copy exists specifically to defeat ransomware, because ransomware deliberately hunts for connected backups to encrypt, and it cannot touch a drive that is unplugged.

A quick self-check is four questions: first, how many independent copies do I have right now? Second, are they on different media? Third, is one of them in a different location? Fourth, is one of them normally unplugged and disconnected? If any answer is no, your backup has a gap worth fixing now.

3. How to Do It: Dividing the Work Between Mac, Windows, Cloud and Offline Drives

The principle is the same everywhere; the tools differ. Here are the four pieces, with each one's role in 3-2-1.

1. Mac: Time Machine as the Local Second Copy

Time Machine is the backup tool built into macOS. Plug in an external drive, go to "System Settings → General → Time Machine", add a backup disk, and it backs up automatically from then on. The first backup covers the whole machine and takes a while; later backups only copy changed files, so they are fast. Apple's official advice is to use a backup disk at least twice the capacity of your Mac's built-in storage, so there is room for version history, and to use the backup disk only for Time Machine, not as general storage.

Time Machine's strength is version history: delete or wrongly edit something and you can recover an older version. By default it keeps hourly versions for the past 24 hours, daily versions for the past month, and weekly versions after that, deleting the oldest when the disk fills up. Turning on encryption protects the data if the disk is lost. But remember: the Time Machine disk is only the "second copy" in your 3-2-1. You still need an offsite copy.

2. Windows: File History vs Windows Backup

Windows users have two built-in tools, and they should not be confused. File History backs up personal files (documents, photos, videos and so on) to an external drive or network location, scanning regularly for changed files, and letting you browse different versions to restore an older file. Windows Backup works at the whole-machine level: it backs up files, settings and installed apps, making it easier to move to a new PC or restore after a reset, and it generally requires signing in with a Microsoft account, with files synced through OneDrive.

In practice, divide the work like this: File History handles the version history of the personal files you edit every day, and Windows Backup handles whole-machine restore when you move to a new PC or reset. Whichever you use, the same principle applies: the backup destination must not be the same drive, and the backup drive itself needs a second, offsite copy behind it. One more important point: backup tools themselves can break — in September 2026, for example, a Windows update stopped File History working, which is covered in our separate article "Thought You Had a Backup? The September Windows Update That Stopped File History — 4 Steps to Verify Your Backup Really Works". So do not just trust a settings screen that says "on"; regularly check by hand that new files are actually landing in the backup.

3. Cloud: the Offsite Copy, With Version Protection Switched On

Cloud storage is the best "offsite copy" in 3-2-1: a fire or flood at home cannot touch it, and you can reach it from anywhere. The method is to put a second copy of your most important files — family photos, company documents, tax records — in the cloud. Free allowances are set by each supplier and are quickly filled by photos, so check the supplier's current plans rather than assuming the free tier is enough.

But cloud storage has two conditions, and both are required. First, confirm that the service you use has version history and restore switched on; do not assume it keeps old versions automatically. Second, the cloud must not be your only backup — you still need a local backup. Sync errors, a locked account, or deletion past the version-retention window can all lose the cloud copy too. Cloud is the offsite layer, not the whole strategy.

4. Offline Drives: Plugged In Once a Week, Unplugged Straight After

This is the most easily forgotten part of the whole strategy, and the most effective against ransomware. Prepare one extra external drive, plug it in once a week, back up, and unplug it immediately. Do not leave it connected. Why? Because ransomware deliberately looks for connected backups to encrypt — a backup drive left plugged in gets encrypted along with everything else. A drive that is unplugged is one ransomware cannot reach, and it is exactly the extra "1" in 3-2-1-1.

Two practical points for offline drives. First, do not use the offline drive as everyday storage; fill it with films and photos and there will be no room left for version history. Second, remember to plug it back in on schedule — pick a fixed day, such as every Sunday evening, and make it a habit. Business users can also rotate offline drives to a second office or to home, which achieves offsite and isolation in one move.

4. Frequency: How Often Is Enough? Ask How Much Work You Can Afford to Lose

There is no single standard answer to this question. The right question to ask yourself is: "If this whole machine vanished right now, how much work could I accept losing?" If you are writing a very important document today and you back up once a month, you could lose a whole month of work. Could you accept that?

As a general rule, actively edited files should be backed up automatically every day, and at least once a week at minimum. Time Machine's hourly automatic backups and File History's regular scans exist precisely so you do not have to remember. Cloud sync is even more immediate — but remember, immediate sync does not mean immediate version-protected backup. Those are two different things.

There are three situations where you must back up manually right away instead of waiting for the automatic run. First, before any major change: a big system upgrade, a reinstall, a drive replacement, or moving company data — back up first, so a failed change leaves you with a last good state to restore. Second, after capturing something irreplaceable — photos from an important event, or finishing an important job — back up that same evening, not later. Third, when the machine starts showing warning signs — strange noises from a drive, frequent crashes, a swelling battery — back up before arranging repairs, not after the machine dies completely.

5. Mistakes: The Five Traps People Fall Into Most

First, leaving the backup drive plugged in all the time. As explained above, ransomware encrypts connected backups too, and a wrongly formatted drive or an accidental deletion by someone else can take the backup out together with the original. Unplugging after backing up is the cheapest, most effective protection there is.

Second, using the backup drive as a general storage drive. Fill a backup drive with films, photos and games and there is no room left for version history; the old versions get deleted automatically, and when you delete a file by mistake and want the version from three months ago, it is already gone. Apple's official advice that a Time Machine disk should be used only for Time Machine is worth following on every platform.

Third, trusting the words "backup successful". A backup report that says "successful" only means "the copying finished". It does not mean "the restore works". Backup drives fail too, files can be corrupt, and the backup settings may have missed a folder. So test-restore at least once a month: pick one or two files, restore them, and check they open. A backup that has never been test-restored is only a backup you think you have.

Fourth, experimenting on a backup drive that is already showing problems. If a backup drive is not recognised or is making strange noises, do not keep switching it on and off, and do not run write-based repair tools on it. Those actions can easily turn a recoverable situation into a permanent loss. The correct move is to stop using it immediately and have it checked by a professional. And remember, backup drives fail too — which is exactly why you need three copies, not all your hopes on one drive.

Fifth, assuming a NAS means the job is done. A NAS still needs its own offsite backup, and its system settings, RAID configuration and user permissions need to be recorded, or you will not know how to restore when the NAS itself fails. See our separate guide "Home / Small-Office NAS: How to Choose, Configure and Back Up? RAID, 3-2-1 and Remote-Access Security". Small businesses should also plan their ransomware restore process; see "Hong Kong Businesses Hit by Ransomware: First Response, Whether to Pay, and Backup Restore".

6. Prevention: A Fifteen-Minute Weekly Checklist, Every Sunday Evening

A backup strategy only lasts if it does not depend on memory. It needs a habit. Here is a checklist that takes fifteen minutes, once a week:

1. Check the local backup's last backup time: is it today, or at least within the last few days? If it stopped a whole week ago, find out why immediately, not later.

2. Check that the cloud offsite copy has your latest files: open the cloud folder and see whether recently edited files are actually there.

3. Plug in the offline drive, back up, unplug it straight away, and note the date.

4. Once a month, actually restore one or two files and confirm they open.

5. Once a quarter, check: how much space is left on the backup drive? Has the cloud free allowance run out? Is any folder missing from the backup (for example, a new project folder, or new files on the desktop)?

Business users need two more items: first, write the backup strategy down, so it does not live only in one colleague's head; second, rotate offline drives to a second location, and do not keep the whole stack of drives next to the server. In a fire, the stack next to the server burns with it.

Frequently Asked Questions

Q: What is the 3-2-1 backup rule?

A: Keep 3 copies of important data, on 2 different media, with 1 copy offsite. Each copy guards against a different disaster: local backups guard against accidental deletion and hardware failure, while offsite backups guard against whole-premises disasters such as fire, flood and theft. The extended 3-2-1-1 version adds one fully isolated copy that is normally disconnected, specifically against ransomware.

Q: My files are already synced to the cloud. Does that mean they are backed up?

A: No. Sync is a mirror: delete a file on your computer and the cloud deletes it too; if ransomware encrypts a file, the encrypted version gets synced to the cloud as well. A real backup needs version history, plus at least one copy that is not synced in real time, and you should confirm the cloud service's version-restore feature is switched on.

Q: How do I set up Time Machine?

A: Plug an external drive into your Mac, go to "System Settings → General → Time Machine", add a backup disk, and it will back up automatically. The first backup covers the whole machine; later backups only copy changed files. Apple's official advice is to use a backup disk at least twice the capacity of your Mac's built-in storage, and to use that disk only for Time Machine, not as general storage.

Q: On Windows, should I use File History or Windows Backup?

A: They do different jobs. File History backs up personal files to an external drive or network location, with file version history, so you can recover older versions. Windows Backup works at the whole-machine level, backing up files, settings and installed apps, which makes moving to a new PC or restoring after a reset easier. In practice you can use both: File History for the daily file-version layer, Windows Backup for the move-to-a-new-PC layer.

Q: How often should I back up?

A: Ask how much work you can afford to lose. Actively edited files should be backed up automatically every day, and at least once a week at minimum. Time Machine's hourly automatic backups and File History's regular scans exist for exactly this reason. Before a big system upgrade, reinstall or drive replacement, make one manual backup immediately beforehand.

Q: Does RAID or a NAS count as a backup?

A: No. RAID only protects against a single drive failure. It does not protect against accidental deletion, fire, theft or ransomware — those affect the whole array. A NAS still needs a separate offsite backup, and its settings and configuration should be recorded, or you will not know how to restore when the NAS itself fails.

Q: How do I know my backup can actually be restored?

A: Test-restore at least once a month: pick one or two files, restore them, and check they open. Reading a "backup successful" report is not enough. If a backup drive is not recognised or is making strange noises, do not keep switching it on and off or run write-based repair tools on it; stop using it immediately and have it checked.

Q: I have no NAS and not many drives at home. What is the simplest way to start?

A: The simplest start still achieves 3-2-1: the original on your computer (copy 1) → one external drive running Time Machine or File History (copy 2) → your most important files also in the cloud (copy 3, offsite). You do not need to buy everything at once. Start with automatic local backup plus cloud, then add an offline drive later. The most important thing is to start today, not after something goes wrong.

Summary

Backup is not just buying an extra drive or switching on sync. Four sentences are enough: first, 3-2-1 — 3 copies, 2 media, 1 offsite, none optional, plus an isolated copy against ransomware for the extended version. Second, sync is not backup, RAID is not backup, and backup drives should not stay plugged in. Third, backup frequency depends on how much work you can afford to lose: actively edited files need daily automatic backup, and major changes need an immediate manual backup beforehand. Fourth, test-restore every month — a backup that has never been test-restored does not count as a backup.

If you are not sure whether your current backup is solid enough, or your backup drive is already showing problems, you are welcome to visit ComputerKing for a free preliminary check, where our technicians will go through the gaps in your current backup with you. Check and repair prices require individual quotes; this article does not estimate them.

Sources

• Apple Support: Back up your Mac with Time Machine: https://support.apple.com/en-us/104984
• Microsoft Support: Backup, restore, and recovery in Windows: https://support.microsoft.com/en-US/Windows/Experience/Backup-Recovery/backup-restore-and-recovery-in-windows
• Related article: Home / small-office NAS guide: https://www.computerking.hk/blog/nas-home-office
• Related article: Hong Kong businesses hit by ransomware: https://www.computerking.hk/blog/ransomware-response-hk-guide
• Related article: The September Windows update that stopped File History: https://www.computerking.hk/blog/windows-file-history-backup-bug-verify-backup-guide