Ransomware-Resistant Backups: How to Make & Test Them
This guide shows you how to build backups that survive a ransomware attack, and how to test them so you know they’ll work when you need them. You’ll learn the 3-2-1 rule, how to use immutable storage, and a simple restore drill you can run today. No special software is required, just a few good habits and a spare hard drive or cloud account.
What You’ll Need
- An external hard drive or USB stick with at least twice the space of the data you want to back up
- A cloud storage account (like Backblaze B2, Wasabi, or AWS S3) that supports object lock or versioning
- A computer running Windows, macOS, or Linux
- Optional: a second external drive for off-site storage
Step-by-Step
- Decide what to back up. List the folders and files you cannot afford to lose: documents, photos, source code, databases, and any configuration files. Skip the operating system and installed programs—you can reinstall those.
- Follow the 3-2-1 rule. Keep at least 3 copies of your data (1 original + 2 backups), on 2 different types of media (e.g., external drive and cloud), with 1 copy stored off-site (like a friend’s house or a cloud region far from you).
- Set up a local backup. Use your operating system’s built-in tool (File History on Windows, Time Machine on macOS) or a free tool like Veeam Agent. Point it to your external drive and schedule daily backups. Make sure the drive is disconnected from the computer when not in use—this prevents ransomware from encrypting it.
- Set up a cloud backup with immutability. Choose a cloud provider that offers object lock (also called Write Once Read Many, or WORM). Create a bucket, enable object lock, and set a retention period (e.g., 30 days). Then use a tool like rclone or the provider’s client to upload your backup. The retention period means that even if an attacker gets your cloud credentials, they cannot delete or modify the backup until the period expires.
- Enable versioning if available. On cloud storage that supports it (like S3), turn on bucket versioning. This keeps every version of a file, so if ransomware encrypts your files, you can restore the previous unencrypted version.
- Create a backup schedule. Automate both local and cloud backups to run daily (or more often for critical data). Set a reminder to check the logs weekly.
- Test your backups by doing a restore drill. At least once a month, pick a random folder from your backup and restore it to a different location. Open the files to make sure they are not corrupted. Then, once a quarter, do a full restore to a spare computer or virtual machine.
- Test your ransomware resistance. Create a test file with a unique name (like “test_restore.txt�), back it up, then pretend it’s encrypted: delete it from your main system. Now try to restore it from your backup. If you can’t, your backup is not working.
- Keep your backup software and OS updated. Ransomware often exploits known vulnerabilities. Patch your system and backup tools regularly.
- Use strong, unique passwords and enable multi-factor authentication (MFA) on your cloud account and on any backup tool that supports it.
Common Mistakes
- Leaving the external drive connected. If the drive is always plugged in, ransomware can encrypt it just like your internal drive. Disconnect it after each backup.
- Only having one backup. If that backup is on the same machine, it can be encrypted too. Always have at least two separate copies.
- Not testing restores. A backup that has never been restored is not a backup—it’s just a hope.
- Ignoring cloud retention settings. If you don’t enable object lock or versioning, a compromised cloud account can delete your backups.
- Using the same password for everything. If your email gets hacked, the attacker can reset your cloud backup password.
Tips
- Use a separate backup computer or a NAS that supports snapshots. Network-attached storage with snapshotting lets you roll back to a pre-attack state.
- Keep your backup drive offline for at least a few hours a day. This is a simple way to ensure ransomware cannot reach it.
- Store a copy of your backup encryption keys offline. If you encrypt your backups, make sure you have a physical copy of the key in a safe place.
- Set up alerts for backup failures. Most backup tools can email you if a job fails. Act on those alerts immediately.
- Consider a “cold� backup. A drive that you connect only once a week, back up to, then disconnect, is your most reliable last resort.
Troubleshooting
Backup fails to complete. Check the backup log for error messages. Common causes: drive full, file locked by another program, or network issue. Free up space, close the file, or retry after restarting.
Restore is slow. If restoring from cloud takes too long, you may have a slow internet connection. Consider using a local backup for speed and cloud for disaster recovery.
Files are corrupted after restore. Run a checksum (like MD5 or SHA-256) on the original and restored files to compare. If they differ, your backup media may be failing—replace it.
Cloud backup is not immutable. If your provider doesn’t support object lock, switch to one that does, or use a tool that writes to a different bucket each day and never deletes old buckets.
You suspect ransomware has hit your system. Disconnect from the network immediately, then restore from your last known-good backup. Do not pay the ransom—there’s no guarantee you’ll get your data back.
Frequently Asked Questions
Q: What is the 3-2-1 backup rule?
A: Keep 3 copies of your data (original + 2 backups), on 2 different media types (e.g., local drive + cloud), with 1 copy off-site.
Q: Can ransomware encrypt my external drive if it’s not plugged in?
A: No. If the drive is physically disconnected, ransomware cannot reach it. That’s why you should unplug it after each backup.
Q: How long should I keep backups?
A: At least as long as your retention policy. For ransomware protection, keep at least 30 days of history so you can recover files that were encrypted before you noticed.
Q: Is cloud backup safe from ransomware?
A: Yes, if the cloud provider supports object lock or versioning, and you use MFA. Without those, a compromised account can delete your backups.
Q: How often should I test my backups?
A: At least once a month for a small restore, and once a quarter for a full system restore. More often if you make major changes to your data.
Q: What if I don’t have a spare computer to test a full restore?
A: You can restore to a virtual machine on your main computer, or just restore a few key folders to a different location. The goal is to verify the files open correctly.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.