How to Back Up Your Phone and Computer (and Make Sure the Copy Restores)

“Back up your data.” It is easy to nod along to and never do. The reason it stalls is that “a backup” is singular, and a singular backup fails in exactly the moment you need it: the drive you backed up onto dies, or the copy sits on the same laptop that got stolen, or the sync folder got encrypted by the same ransomware as the original. A backup that survives real life is plural and separated. The standard shorthand for that is the 3-2-1 rule.

What is the 3-2-1 backup rule?

Backblaze, a backup company, popularized the 3-2-1 phrasing, and it has become the field’s default: keep three copies of anything you cannot recreate, on two different kinds of storage, with one copy somewhere other than your home or main device.

• Three copies = the original on your device, plus two backups. (The original counts as one; you still need two more.)
• Two media = don’t put both backups on the same kind of drive. A phone’s internal storage plus a USB stick plus a cloud account is three media; two USB sticks from the same drawer is effectively one failure mode.
• One offsite = at least one copy physically or geographically separate, so a house fire, theft, or flood doesn’t take the original and the backup together. Cloud storage covers this automatically.

The principle underneath — keep redundant copies and keep at least one away from the thing it protects — is the same one federal contingency-planning guidance applies to government systems. NIST’s SP 800-34r1 tells agencies to maintain backup copies of their systems and store them separately from the systems themselves. You are applying that idea to a phone and a laptop.

Why start with the phone?

A phone feels like it already lives in the cloud, but most of what is irreplaceable on it — photos not yet uploaded, message history, app data, local files — is only as safe as the last sync.

iPhone. Apple backs up an iPhone two ways: iCloud, which runs automatically when the phone is charging, locked, and on Wi-Fi, and a computer backup through Finder (macOS) or the Apple Devices app (Windows). iCloud is the offsite copy by default. Turn it on once in Settings → your name → iCloud → iCloud Backup, and it stops being something you remember to do. For a second, local copy, back up to a computer occasionally — useful if you ever switch to a non-Apple cloud or want a version the cloud doesn’t hold.

Android. Google backs up app data, call history, contacts, settings, and SMS to your Google Account, and Google Photos handles the picture library separately. It is automatic once backup is enabled in Settings → Google → Backup. As with iPhone, that cloud copy is your offsite one; a periodic computer copy adds the second local copy.

The mistake to avoid: treating the phone’s “sync” as a backup when it is really a mirror. If you delete a photo and it is mirrored everywhere, it is gone from all copies. Versioned cloud backup (below) is what survives an accidental delete.

What about the computer?

A computer is where the 3-2-1 rule earns its keep, because that is where the large, hard-to-recreate files live: years of documents, a photo library, a project you cannot rebuild.

Windows. Two built-in routes: File History copies your files to an external drive on a schedule, and OneDrive can keep a synced copy of your folders in the cloud. Use both — the external drive is your fast local restore, OneDrive is your offsite. (The older “Backup and Restore (Windows 7)” tool still exists for full system-image backups, but File History covers most people.)

Mac. Time Machine is the native route: plug in an external drive, turn it on, and it makes hourly, daily, and weekly snapshots you can browse like a timeline. Pair it with an iCloud or other cloud copy for the offsite leg.

A dedicated computer-backup service. Services such as Backblaze run continuously in the background and keep version history — older copies of changed or deleted files — for a set window, often long enough to recover something you deleted months ago. That version history is the feature that defeats both accidental deletion and ransomware, because the backup holds pre-attack states.

Is cloud backup enough — and what is the fine print?

Cloud storage and cloud backup are not the same thing, and the difference matters for rule 2 (two media) and rule 3 (offsite).

• Sync folders (iCloud Drive, Google Drive, OneDrive) mirror files. Great for offsite access and for surviving a dead laptop, but a mirrored copy follows your deletes and can be encrypted by ransomware that reaches the synced folder.
• Backup services (Backblaze, IDrive, Carbonite, and the phone and computer cloud backups above) keep independent copies, usually with version history, so a change on your device doesn’t immediately destroy the backup.

For a true 3-2-1, you want at least one backup (not just a sync) in the mix. A sync folder alone is one media that happens to be offsite — better than nothing, but it fails the “two media” and “survives your own mistake” tests.

How do you keep one copy ransomware can’t reach?

Ransomware works by encrypting your files and demanding payment; if your backup is a live sync the malware can write to, it encrypts the backup too. The defenses fall straight out of 3-2-1:

• An external drive that isn’t plugged in most of the time is unreachable during an attack. Run it weekly, then unplug it.
• A backup service with version history keeps pre-attack copies even if the live sync is hit, because it stores older versions separately.
• Turn on multi-factor authentication on the cloud account, so an attacker can’t just delete your backups from the dashboard.

This is the one place where “set and forget” needs a check: confirm the offsite copy is actually a backup with history, not a sync that mirrors the infection.

How do you prove your backup restores?

The most common backup failure is a backup nobody ever tested — and it is discovered on the worst day. Once a month, or after a big change, restore one file from each backup to a throwaway location: a photo from the cloud, a document from the external drive. If you can open it, the copy is real. If you can’t find the restore button, neither can you, later, under stress.

Testing also catches the silent killer: a backup that has been “running” but backing up the wrong folder, or nothing at all. Most services show a last-successful-backup time — glance at it.

How often should you back up, and what should you automate?

• Continuous: the cloud or sync copy, which updates as you work.
• Weekly: the external-drive copy (set it to run on a schedule, or just plug in the drive; both Windows File History and Time Machine do this automatically once configured).
• On demand: before a big change — a system update, a device switch, a trip.

You don’t need enterprise software. For most households the whole system is: phone cloud backup on, computer files in a sync folder, one external drive with Time Machine or File History, and (optional) a backup service for version history. That is three copies, two media, one offsite — and it costs little beyond a drive you would buy anyway.

What is the bottom line on backups?

Back up plural and separated, not singular. Turn on the phone’s cloud backup, point the computer at an external drive and a cloud account, and make at least one of those a real backup with version history rather than a bare sync. Then restore one file a month so you know the copy is real. If you are reading this because something already went wrong, the first-72-hours steps are in What to Do After a Data Breach Notice, and how a freeze differs from an alert is in Credit Freeze, Fraud Alert, or Credit Lock.

Byte is the technology site of the Omni Mundi Compendium network. How to keep accounts from being taken over in the first place is in Two-Factor Authentication: Which Method to Use.

This article is general information about data backup, not professional IT advice. It is AI-written and independently AI-reviewed before publication; the review standard and this article’s findings are recorded in the network’s editorial review log.