A Home Backup Plan That Can Survive Ransomware

1. Decide what you need to save and how much you can lose

List the files that would hurt to lose: original photos and videos, financial records, creative work, scanned documents and anything needed to manage your household. Include files scattered across laptops, desktops and phones. Check whether cloud photo libraries contain originals on your computer or only previews. A backup of a folder full of online-only placeholders may not contain the actual files; verify that your chosen tool downloads or otherwise captures them.

Then decide how recent a recovery must be. A weekly backup can leave almost a week of new work unprotected. Someone editing client projects at home may need daily backups, while a rarely changed document archive needs fewer updates. Measure the selected data before buying storage, and leave room for growth and older versions. A drive that holds today's files exactly is unlikely to support useful history for long.

• Identify essential folders and the device or account holding each original.
• Separate irreplaceable files from apps, downloads and media you can obtain again.
• Record your acceptable loss window: a day, a week or another realistic interval.
• Include recovery instructions, but keep passwords and recovery codes in secure storage.

2. Build separate copies without buying a complicated system

The familiar 3-2-1 guideline is a useful starting point: three copies of important data, on two types of storage media, with one copy offsite. Count your working files as one copy. For home ransomware protection, add a crucial condition: at least one backup should be offline or protected against modification and deletion. Three accessible copies are not three independent defenses if the same compromised computer or account can destroy all of them.

A practical setup is your computer, a rotating pair of external drives and an offsite copy. For modest budgets, ordinary external hard drives often offer more capacity per dollar than portable solid-state drives; speed matters less than completing backups reliably. Compare current prices and usable capacity rather than paying for a security label. Two drives are separate devices, not necessarily different media types, but rotating them offline still creates a valuable barrier. If money is tight, back up the essentials first and expand coverage later.

3. Make the offline step part of the routine

Label two drives A and B. Connect A for a scheduled backup, confirm the job finished, safely eject it and disconnect it. At the next interval, use B. Keep the unused drive disconnected throughout. When practical, store one in a separate, secure location to reduce exposure to theft, fire or a household accident. Encryption helps protect a lost drive, but it does not stop ransomware from altering files while that drive is unlocked and accessible.

Rotation is only useful if the software keeps recoverable history. A job that simply mirrors the current folder may replace good files with encrypted ones or remove files deleted on the computer. Choose versioned backups and check how old versions expire when storage fills. An offline drive also remains vulnerable during its connection window. If the computer shows a ransom note, unexplained file changes or other signs of compromise, do not connect either backup drive to investigate.

• Put the backup appointment on a calendar and alternate the labeled drives.
• Check completion and available space before disconnecting; plugging in is not confirmation.
• Store encryption recovery information separately from the drives, somewhere you can access without the computer.
• Never connect both rotating drives just to make the routine faster.

4. Check whether cloud protection survives an account attack

Cloud syncing is useful, and some services offer version history or rollback features that can help after ransomware. But syncing is designed to keep locations aligned, not necessarily to preserve an independent archive. An encrypted file may upload as the newest version; a deletion may spread. A synced folder on another computer is not an offline backup simply because it lives on a second machine. Recovery depends on the service's specific features and limits.

For any cloud option, read the recovery rules for the exact plan you would buy. Check how long overwritten and deleted files remain recoverable, whether whole-account rollback is available and whether an attacker with your login could empty the recovery area. Some backup services offer locked retention, delayed deletion or immutable storage. Those terms are not interchangeable: verify which changes are blocked, who can override them and whether protection must be enabled before an attack.

• Use a unique password and multifactor authentication; prefer phishing-resistant options when supported.
• Protect the recovery email account too, and save recovery codes outside the computer being backed up.
• Check whether cloud originals, external drives and every household device are actually included.
• Verify download charges, large-restore options and retention after cancellation or a missed payment.

5. Automate the work, not the assumption that it succeeded

Use your operating system's backup features or reputable backup software that supports your chosen destinations and file history. Check the current documentation for your OS version: a feature called backup may preserve settings or selected folders rather than every local file. Some tools need a separate configuration for external storage. Enable failure alerts if available, and review the last successful backup at least as often as your acceptable loss window.

Automation works best for the protected offsite copy and for local jobs that run when you attach a drive. Keep a brief log of the date, destination and result. Watch for excluded folders, permission errors, stalled uploads and a destination that has run out of space. An initial upload can take considerable time on a slow connection, so do not count it as complete coverage until it finishes. A network storage box can simplify household backups, but an ordinary writable share can also be reached by ransomware. It needs its own restricted access and protected recovery copies.

6. Test recovery with files you can actually open

A green completion message is evidence that a job ran, not proof that your recovery plan works. Test the setup after the first backup, then repeat periodically, such as every few months and after a major software or account change. Restore into a temporary folder rather than overwriting current files. Open the restored items in their normal applications and confirm that the contents are usable, not merely that filenames appear.

Include an older version, a deleted file and something large enough to expose problems that a tiny text file would miss. If you expect to recover a whole computer, verify what that requires: installation media, compatible hardware, recovery keys or a separate system image. Practice retrieving your instructions without relying on the backed-up computer. Also consider time. Downloading a large photo archive may take far longer than retrieving a few documents, so identify which files you would restore first.

• Restore a recent document, an older version and a deleted sample file.
• Open several photos and play part of a restored video.
• Confirm you can unlock an encrypted backup using your saved recovery information.
• Write down the test date, any failures and the changes needed.

7. Keep a short ransomware recovery plan beside the backup plan

If you suspect ransomware, disconnect the affected computer from Wi-Fi and wired networks, and disconnect attached backup storage. Do not attach your offline copies or start a fresh backup that could overwrite useful history. Stop using the affected device and seek qualified help if you are unsure how to contain the incident. For a work-managed computer, contact your employer's IT team immediately. Preserve the ransom message and relevant details without opening unfamiliar links or files.

Before restoring, use a clean device to secure affected accounts and assess whether other household devices or shared storage were exposed. Recovery generally means cleaning or reinstalling the affected system and restoring known-good data, not copying files back onto an infected machine. Choose a recovery point from before the suspected compromise; the newest backup is not automatically safe. Update software and investigate how access occurred before reconnecting everything. If sensitive information may have been stolen, backups cannot undo that exposure. Address account security and identity risks separately. The affordable defense is a repeatable habit: separate the copies, protect one from change and prove restoration works.