The 3-2-1 Backup Strategy

Three copies means your working data plus at least two backups. One copy is a single point of failure — the laptop that falls in a river takes the year with it. Two different media (or systems) means you avoid correlated failure: internal SSD plus external drive, or computer plus reputable cloud backup. Same brand of cheap USB sticks cloned three times is weaker diversity than people think. One off-site copy — cloud backup or a drive stored at another building — protects against fire, flood, burglary, and ransomware that encrypts everything still plugged into the infected machine.

Modern ransomware and stealers look for connected backup disks, synced folders, and network shares. If your only "backup" is an external drive mounted 24/7, malware can encrypt or delete that too in one pass. Offline / infrequently connected copies and true off-site copies create a gap malware cannot cross in a single click. Cloud backups with version history also help: you may roll back to yesterday's clean file instead of paying a criminal.

Encryption and account security still matter for off-site copies. Use reputable providers, unique passwords, MFA on the cloud account, and understand whether files are encrypted in transit and at rest. A public link to your entire photo vault is not a backup strategy — it is a leak. Keep recovery keys for encrypted volumes offline and tested.

The bitter lesson of backups: people discover corruption, wrong folders, expired credentials, or empty sync clients only during the emergency. Schedule a restore drill. Pick three sample files — a photo, a PDF, a spreadsheet — restore them to a temporary folder from each backup layer you rely on, and open them. Calendar a reminder every 90 days. If restore fails, you found a problem while you still have time to fix it.

Prioritize what matters: identity documents, tax records, creative work, password-manager emergency kits, and irreplaceable photos before your entire Steam library. Perfect totality is less important than reliable coverage of the files you cannot re-download from the internet. Combine 3-2-1 with Module 6's patching so ransomware is less likely — and with upcoming incident response so you know not to pay for decryptors when a clean backup exists.

Phone photos deserve a special note: many people believe "it is in the cloud" without knowing which account, whether Optimized Storage left only thumbnails online, or whether a full-resolution download still works after a wipe. Open your photos settings on YOUR phone, confirm backup is actually enabled to an account you control with MFA, and restore one image to another device or a laptop as proof. Cloud marketing slogans are not a restore drill.

1. Primary: phone/laptop photos & documents (working copy)
2. Second copy: external drive OR second computer (different media)
3. Off-site: reputable cloud backup / encrypted cloud folder

A. Pick 3 sample files (photo, PDF, spreadsheet)
B. Restore them to a temporary folder from the backup
C. Open each file — confirm it is readable
D. Calendar reminder: repeat every 90 days
E. Confirm cloud account has MFA + unique password

- Unplug external drives when not actively backing up
- Prefer backup tools with version history / snapshots
- Do not keep the only cloud login cookies on the same infected PC forever
  (know how to access backup from a clean device)

[ ] Identity / tax / medical PDFs you own
[ ] Irreplaceable photos/videos
[ ] School/work projects not stored elsewhere
[ ] Password manager emergency export / recovery kit (offline, careful)

- Pay random "decryptor" sites as your first plan
- Back up other people's private data without permission
- Post backup archives to public links
- Assume green "synced" icons mean a restore was tested

mkdir -p "$HOME/cyberlium-lab/primary" "$HOME/cyberlium-lab/backup-copy"
echo "demo document $(date)" > "$HOME/cyberlium-lab/primary/demo.txt"

cp -a "$HOME/cyberlium-lab/primary/demo.txt" "$HOME/cyberlium-lab/backup-copy/demo.txt"

ls -l "$HOME/cyberlium-lab/primary" "$HOME/cyberlium-lab/backup-copy"

cp "$HOME/cyberlium-lab/backup-copy/demo.txt" "$HOME/cyberlium-lab/primary/demo-restored.txt"

New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\cyberlium-lab\primary","$env:USERPROFILE\cyberlium-lab\backup-copy" | Out-Null
"demo document $(Get-Date)" | Out-File "$env:USERPROFILE\cyberlium-lab\primary\demo.txt"
Copy-Item "$env:USERPROFILE\cyberlium-lab\primary\demo.txt" "$env:USERPROFILE\cyberlium-lab\backup-copy\demo.txt"

Backups are your recovery superpower — only if tested and partly offline/off-site. Next — Physical Security Basics — because a stolen unlocked laptop or a shoulder-surfed PIN can bypass carefully synced clouds before you ever need restore.