Chapter 7
3-2-1-1-0 backups: why sync is not backup
7.1 Learning objectives
- Explain the 3-2-1-1-0 rule.
- Distinguish sync, hardware redundancy (RAID) and backup.
- Assess how many digits of 3-2-1-1-0 your current system achieves.
7.2 Concepts
The 3-2-1-1-0 rule
| Digit | Meaning |
|---|---|
| 3 | At least 3 copies of the data (the primary + 2 backups) |
| 2 | On at least 2 different types of storage media |
| 1 | At least 1 copy offsite |
| 1 | At least 1 immutable or air-gapped copy |
| 0 | 0 errors on restore: regular, verified restore tests |
Sync, RAID, backup
| Concept | Protects against | Does not protect against |
|---|---|---|
| Cloud sync | Losing a device | Accidental deletion, ransomware (changes are synced too) |
| RAID / mirrored drives | One drive failing | Accidental deletion, malware, whole-device failure, fire |
| Versioned backup | Accidental deletion, malware (if older versions exist) | Losing the backup location itself without an offsite copy |
| Immutable / air-gapped copy | Malware, attackers with admin rights | Disasters at the same location (offsite also needed) |
A copy within the same cloud account (folder A copied to folder B) is not a backup. Same account, same risk.
Verifying with hashes
When copying data, compute a hash (e.g. SHA-256) at source and destination and compare. A match means the copy is bit-for-bit identical. Rule: never delete the source before comparing hashes.
7.3 Worked example
Mr. A's old system: laptop + a cloud-synced folder. Mr. A thought he had 2 copies. In reality:
- Accidentally delete on the laptop → the cloud deletes too a few seconds later.
- The cloud trash keeps items for 30 days; Mr. A noticed after 45 days.
New system:
| Digit | Implementation |
|---|---|
| Copy 1 (primary) | NAS at home |
| Copy 2 | External SSD, versioned backup software, encrypted |
| Copy 3 (offsite) | Cloud object storage, backup with client-side encryption |
| 2 media types | HDDs in the NAS + external SSD + cloud |
| 1 immutable | Immutable snapshots on the NAS, locked for 30 days |
| 1 air-gapped | The external SSD is plugged in only while the backup runs, then unplugged |
| 0 errors | Each month restore a random folder as a test and compare hashes |
7.4 Common mistakes
- Calling a sync folder a backup.
- Treating RAID as backup.
- Encrypting backups but not keeping the encryption key elsewhere (see Chapter 9).
- Never having tested a restore.
- Deleting source data right after "copying is done" without verifying.
7.5 Checklist
7.6 Exercises
- Score your system: how many digits of 3-2-1-1-0 does it achieve?
- Practice: copy a 1 GB folder to another drive, compute SHA-256 on both sides and compare.
- Scenario: "Ransomware encrypts your whole laptop at 2 a.m." In the morning, which of your copies is still clean?
7.7 Summary
- Sync is not backup; RAID is not backup.
- 3-2-1-1-0: the "0" digit (restore testing) is the one most often skipped.
- Delete nothing before comparing hashes.