Build a Backup Plan That Survives Ransomware

Matthew Leo · Published August 2, 2026 · Guides

Ransomware backup plan

A folder synchronized to the cloud is useful protection, but it is not automatically a complete backup.

Synchronization is designed to keep files consistent across devices. That convenience can also copy unwanted deletions, damaged files or account changes everywhere before the owner realizes something is wrong.

An external drive solves different problems. It can preserve a local history and restore large amounts of data without a long download, but it cannot protect anything if it is never connected—or if it remains connected when ransomware reaches the computer.

The stronger plan uses both.

The practical answer: follow the 3-2-1 rule

The Canadian Centre for Cyber Security recommends the 3-2-1 approach:

For an ordinary household or independent business, that could mean the working files on a computer, an automated backup on an external drive and an encrypted cloud copy protected by multi-factor authentication.

The external drive helps after hardware failure, accidental deletion or a poor software update. The off-site cloud copy remains available if theft, fire or flooding takes both the computer and the nearby drive.

Cloud sync and cloud backup are not identical

Services such as OneDrive, iCloud Drive and Google Drive synchronize files across connected devices. Many include version history and deleted-file recovery, which can rescue an earlier copy after a mistake.

Those protections have limits. Retention periods vary, storage can fill, and an attacker controlling the cloud account may delete or encrypt files. A synchronized folder also excludes data stored elsewhere unless the user deliberately includes it.

Before treating a cloud service as a backup, confirm:

The Canadian Cyber Centre notes that cloud providers may offer security expertise a household or small organization cannot reproduce. It also advises customers to understand the provider’s safeguards, incident process and data location.

An external drive should not stay connected forever

An automated local backup is valuable because it creates repeated copies without depending on memory. Once that backup finishes, however, a removable drive can be disconnected and stored safely.

The Cyber Centre recommends offline backups for ransomware recovery. Malware cannot normally encrypt a drive that is unplugged and unavailable to the infected system.

A drive connected permanently to the computer may be convenient, but it remains exposed to ransomware, accidental formatting, electrical damage and theft affecting the same room.

For more frequent automation, some households use two drives in rotation. One remains available for the next backup while the other is disconnected or stored elsewhere.

Set up File History on Windows 11

Microsoft continues to provide File History for creating repeated copies of personal files on an external drive or network location.

  1. Connect an external storage drive.
  2. Open Control Panel.
  3. Select System and Security.
  4. Select Save backup copies of your files with File History.
  5. Choose the drive and turn File History on.

Microsoft’s current File History instructions explain how to configure the destination and restore earlier versions.

Windows Backup can separately synchronize selected folders and settings through OneDrive. Review the included folders under Settings, Accounts and Windows backup rather than assuming every file on every drive is covered.

After the first local backup, open File History and restore a harmless test file to another folder. A backup that has never completed a test restoration remains a promise, not proof.

Use Time Machine on a Mac

Time Machine can automatically back up applications, documents, photographs, email and other data to supported storage.

  1. Connect an external drive.
  2. Open System Settings.
  3. Select General, then Time Machine.
  4. Add the backup disk.
  5. Enable encryption and save the recovery password securely.

Apple says Time Machine keeps hourly, daily and weekly backups, removing older copies when the destination becomes full.

iCloud does not create a complete restorable copy of a Mac. Apple’s own guidance distinguishes synchronized iCloud content from Time Machine’s ability to recover broader files and system data.

Test Time Machine by entering its recovery interface and restoring a non-critical file. Do not wait until the original drive fails to learn that the backup disk had quietly stopped connecting.

Protect the backup accounts and drives

A cloud backup inherits the security of its account. Use a unique password, enable multi-factor authentication and store recovery codes away from the computer and phone being protected.

External drives containing sensitive information should be encrypted. Store the recovery key somewhere separate; encryption is remarkably effective at protecting a backup from its owner when the only password is forgotten.

Also inspect drive health and replace unreliable media. Backups are working equipment, not archival furniture that becomes more trustworthy after sitting untouched for eight years.

Choose what deserves priority

Begin with information that cannot be recreated:

Downloaded films and applications can usually be replaced. Personal records and original work may not be.

Mapletechie’s iPhone storage guide makes the same distinction: clearing space and protecting data are separate tasks. Do not delete local photographs because they appear online until the backup and synchronization behaviour is understood.

Run a recovery test every few months

A useful test does not require erasing the computer. Choose several files, restore them to a temporary location and confirm that they open correctly.

Then check:

The best backup plan is not the most elaborate one. It is the plan that runs regularly, keeps at least one copy away from the original device and has already demonstrated that it can restore a file.

Tags: backups, cloud storage, external drives, ransomware, data recovery

Read on Mapletechie