← Knowledge Base

Knowledge Base

The 3-2-1 Backup Rule, Explained

Updated August 7, 2026

The 3-2-1 backup rule says: keep 3 copies of any data you care about, on 2 different types of media, with 1 copy offsite. This article explains what each number actually requires, where the rule came from, the common ways a setup can follow the letter of the rule and still lose data, and the one thing the rule never mentions: proving your copies are still intact.

The rule in one paragraph

Three copies means your working original plus two backups. Two media types means those copies do not all share one failure mode: disk and tape, or disk and cloud, not three folders on the same drive. One offsite means at least one copy survives the event that takes out the building: fire, flood, theft, or a ransomware attack that reaches everything on the network. Follow all three numbers and no single event, mistake, or failure can take your data from three copies to zero.

Where the rule comes from

The formulation was popularized by photographer Peter Krogh in his work on digital asset management in the mid-2000s, and it spread because it compresses real failure statistics into something you can hold in your head. Drives fail, buildings burn, people delete the wrong folder. The rule survives because each number blocks a different class of loss: 3 covers device failure, 2 covers a shared media weakness, 1 covers site-level disaster. Twenty years later, government security agencies and every serious backup vendor recommend it in some form.

What counts as a copy

A copy is an independent, restorable instance of the data. Some things that look like copies are not:

  • RAID is not a copy. RAID protects against a drive failing inside one system. Delete a file, and the deletion is faithfully mirrored everywhere in the array. One logical copy, however many disks it spans.
  • A sync folder is not a copy. Dropbox-style sync propagates changes, including destructive ones, to every replica within seconds. Unless versioning is on and long enough to notice the damage, a sync is one copy that lives in several places.
  • A copy you cannot restore is not a copy. A backup written by software you no longer have, in a format nothing current can read, fails exactly when you need it. This is why open formats matter more the longer data has to live. See the on-media format Hiberden uses for what restore-without-the-vendor looks like in practice.

What counts as two media types

The point of the second number is separating failure modes, not ticking a box. Two internal hard drives are one media type: same technology, same power event, same controller, often the same manufacturing batch. Meaningful pairs differ in how they fail:

  • Disk + LTO tape. Disk fails electrically and mechanically while powered; tape on a shelf has no power, no controller, and no attack surface. This is the classic archival pairing.
  • Disk + cloud object storage. The cloud copy rides on someone else's redundant infrastructure with its own, different risks: account compromise, misconfiguration, a missed invoice.
  • Tape + cloud. Two offsite-capable media with almost no shared failure mode at all.

What counts as offsite

Offsite means a different failure domain, not just a different room. A cartridge in a fire safe in the same building fails the spirit of the rule. Common honest implementations: cloud storage in your own account, or tapes rotated to another site.

Offsite and offline are different properties, and ransomware made the difference matter. A cloud copy is offsite but reachable: malware with your credentials can encrypt or delete it. A tape on a shelf is offline: nothing that happens on the network can touch it. The strongest position is one copy that is both, which is why tape kept on a shelf offsite remains the archival anchor even in cloud-first setups.

3-2-1-1-0 and the other variants

Backup vendors have extended the rule, and the extensions are worth understanding even if you keep calling the whole thing 3-2-1:

  • 3-2-1-1-0 adds a second 1: one copy offline or air-gapped (the ransomware clause), and a 0: zero errors when the backups are verified. The zero is the interesting part. It concedes that unverified copies fail restore tests often enough that verification had to be written into the rule itself.
  • 4-3-2 and similar variants add copies and sites for higher-stakes data. The structure is the same idea with bigger numbers.

The part the rule does not say: verification

3-2-1 counts copies. It says nothing about whether any of them can still be read. Storage degrades silently: a disk sector goes unreadable, a cloud upload was corrupted in transit, a tape block develops errors that on-media error correction masks until it cannot. A copy that has not been read back since it was written is a hope, not a backup. The 0 in 3-2-1-1-0 exists because the industry kept meeting backups that counted perfectly and restored nothing.

The fix is mechanical, not philosophical: record a cryptographic hash of the data when you write each copy, then periodically re-read every copy and re-hash it against the record. A copy that passes is proven intact as of that date. A copy that fails is flagged while you still have two good ones to repair from. That discipline is what Verified 3-2-1 means in Hiberden, and How verification works covers the mechanism.

3-2-1 for backup versus 3-2-1 for archive

Backup protects the recent working set so you can get back to work: short retention, frequent runs, restore speed first. Archive preserves finished data for years or decades: footage, datasets, records that are expensive to create and impossible to recreate. The rule applies to both, but archive raises the stakes on two of its assumptions. Media must be rated for long life on a shelf, which is where LTO tape earns its place. And formats must outlive vendors: in thirty years the question is not whether your software still runs, it is whether the bytes are readable by anything at all.

A 3-2-1 shape that works at archive scale

A typical verified 3-2-1 for large media or research archives:

  • Copy 1 on LTO tape, the archival spine, offline on a shelf and offsite once it leaves the building.
  • Copy 2 on local disk or NAS, fast to restore from.
  • Copy 3 in your own S3-compatible cloud account, the always-reachable offsite.

Three copies, at least two media types, one offsite, one fully offline, and every copy re-readable and re-hashable on demand. 3-2-1 for video archives works through this shape for footage libraries specifically.

Where to go next