3.5Backup & restore
The essentials in 30 seconds
- The 3-2-1 rule: 3 copies of the data, on 2 types of media, 1 of which is kept off-site — enough to survive a failure, a fire or a theft.
- An untested backup does not exist: you plan regular restoration tests to check that the data really comes back.
- RPO = tolerable data lost; RTO = recovery time; against ransomware, an offline or immutable copy is vital.
Running mini-case — Sofiane takes over the SME's backup
Sofiane, a systems administrator in a distribution SME in Algiers, inherits the backup of the file server. He audits it: a single copy, on a single disk, permanently connected. He reacts according to the 3-2-1 rule: he adds two distinct media and an off-site copy, one of which is offline to withstand ransomware. Above all, he plans a regular restoration test, because he knows that an untested backup does not exist. Finally, he frames the objectives with the business: how much data can be lost (RPO) and how quickly must operations resume (RTO). He notes the reflex: a backup is judged by its restoration, not by its mere presence.
Standalone case for this section: it returns in the lesson, the diagram, the script and the 48h challenge of section 3.5.
1. The 3-2-1 rule
A good strategy fits in a formula: 3 copies of the data, on 2 different types of media, 1 of which is kept off-site. Thus a disk failure, a fire or a theft do not destroy everything at the same time. The off-site (or cloud) copy is what saves the day in case of a local disaster.
2. Backup ≠ restoration
The classic trap: you back up for months… and on the day it is needed, the restoration fails (unreadable media, incomplete backup, forgotten procedure). An untested backup does not exist. You therefore plan regular restoration tests to check that the data really comes back, and within an acceptable time.
3. RPO, RTO and ransomware
Two markers frame the objective: the RPO (how much data you can afford to lose → backup frequency) and the RTO (how quickly you must be back up and running). Faced with ransomware, an offline or immutable backup is crucial: if the whole network is encrypted, only a copy the attacker cannot reach makes it possible to resume without paying.
🔎 Concrete example — 🔎 Concrete example — Ransomware encrypts the whole network
One Monday, all the server's files are encrypted and a ransom is demanded.
Backup on an accessible network share -> encrypted too
Backup offline / immutable -> intact
-> restoration possible without paying the ransomReading: a permanently connected backup is encrypted along with the rest.
Lesson: the off-site/offline copy (the “1” of 3-2-1) makes all the difference.
Section vocabulary
- 3-2-1 rule
- 3 copies of the data, on 2 types of media, 1 of which is off-site.
Simple example: Sofiane adds two media and an off-site copy.
What it is not: a single copy on a single disk.
Reflex: robust backup → 3-2-1.
- Restoration test
- Regular verification that a backup really restores.
Simple example: Sofiane restores a control file to verify.
What it is not: assuming the backup will work without trying it.
Reflex: reliable backup → having restored it.
- RPO
- Maximum acceptable data loss; dictates the backup frequency.
Simple example: Sofiane backs up more often if the RPO is short.
What it is not: the recovery time after an incident.
Reflex: how much data to lose → RPO.
- RTO
- Maximum acceptable duration to be operational again.
Simple example: Sofiane targets a short RTO for the file server.
What it is not: the tolerable amount of data lost.
Reflex: how quickly to resume → RTO.
- Immutable / offline backup
- Copy that an attacker can neither modify nor encrypt.
Simple example: The offline copy survives ransomware.
What it is not: a network share permanently accessible.
Reflex: withstand an attack → offline.
In practice — In practice — Auditing a backup strategy
- For important data, count the number of copies and the types of media, like Sofiane.
- Check that at least one copy is off-site (or in the cloud).
- Ask for the date of the last successful restoration test.
- Estimate the real RPO and RTO, then note what is missing from the 3-2-1 rule.
Step-by-step script — auditing a backup like Sofiane (4 min)
1) Count the copies of the data and the types of media. 2) Check that at least one copy is off-site. 3) Ask for the date of the last successful restoration test. 4) Identify whether a copy is offline or immutable (anti-ransomware). 5) Estimate the RPO and RTO, then note what is missing from the 3-2-1.
A backup never restored may not work on the day it is needed: plan a regular test, not just a copy.
Copy-paste template — my 3-2-1 sheet
Copies : 3 (including 1 off-site / cloud)
Media : 2 different types
Offline : yes (immutable, anti-ransomware)
Restoration test : date of the last successful attempt -> __
RPO (tolerable data lost) : __
RTO (recovery time) : __
Rule : an untested backup does not existA single local copy
Sofiane detects a single connected copy: he adds two media and an off-site copy.
Ransomware strikes
The offline copy stays intact: Sofiane restores without paying the ransom.
A restoration test
Sofiane restores a control file: the procedure works, within the intended time.
Framing RPO and RTO
Sofiane checks that the backup frequency covers the data loss tolerated by the business.
✓ Best practices
- Respect the 3-2-1 rule.
- Test restoration regularly.
- Keep an offline or immutable copy against ransomware.
✗ Common pitfalls
- Believing a backup exists without ever having restored it.
- Having only a single copy, on a single medium.
- Leaving all backups connected to the network.
Key takeaways
- 3-2-1: 3 copies, 2 media, 1 off-site.
- An untested backup does not exist: test the restoration.
- RPO = tolerable data lost; RTO = recovery time.
- Against ransomware, an offline or immutable copy is vital.
48h challenge — apply it tomorrow
Like Sofiane, audit the backup of a data set that matters to you: count the copies and the media, check that a copy is off-site (and ideally offline), then note the date of the last restoration test. Write in one sentence what is missing to meet the 3-2-1 rule.
- I can explain the 3-2-1 rule and why it protects against disaster.
- I know that an untested backup does not exist.
- I distinguish RPO and RTO and spot the weak link of a strategy.
Frequently asked questions
How often should you back up?
It depends on the RPO: if losing a day's work is unacceptable, you back up at least daily, or even continuously for critical data. The frequency is deduced from what you can afford to lose.
Does the cloud replace the 3-2-1 rule?
The cloud often provides the off-site copy, but does not dispense with the other principles: several copies, varied media and above all restoration tests. Data that exists only in a cloud service, never verified, remains a risk.
What does the 3-2-1 rule of a good backup say?