The 3-2-1 Backup Rule for a Home NAS

Three copies of the data, on two different types of media, with one copy offsite. That is the whole rule, it is forty years old, and it survives because each clause removes a different class of event that would otherwise take everything at once. The clause people skip is the third, and the misunderstanding people carry is that the array itself counts as two of the copies. It does not. RAID is not a backup, and the rest of this page is mostly about why that sentence is literal rather than pedantic.

What is the 3-2-1 backup rule?

3-2-1 is a minimum specification for how many independent copies of your data exist and where they are. Take each number in turn.

• Three copies. The live data on the NAS is copy one. A local backup on a separate device is copy two. An offsite copy is copy three. Three exists because two copies means one failure away from one copy, and one copy is the state you are trying to leave.
• Two media types. Originally tape against disk. In practice today it means two different failure domains: an array of spinning drives and a single external drive is a weaker split than an array of spinning drives and a cloud target, but both beat two identical devices in the same cupboard bought in the same order. The point is that whatever kills one should not be able to kill the other.
• One offsite. The clause that covers fire, flood and theft. A drive in a desk drawer next to the NAS is not offsite. A drive at a relative's house, in a bank box or in an office desk is.

Written as a shopping list, the minimum viable version for a home NAS is: the array, one external drive that lives with it, and a second external drive that lives somewhere else and gets swapped every few weeks. That is roughly $1,230 for a pair of 18 TB drives on top of the array, and it satisfies all three numbers.

Why is RAID not a backup?

Parity is redundancy against hardware failure, computed continuously and applied to whatever the filesystem writes. It has no concept of whether the write was intended. Delete a folder and the deletion is protected with perfect redundancy across every member. That is not a bug in RAID, it is the definition of what RAID is for.

Here is the same idea as a table, because the list of things parity does not cover is longer than most people expect.

Parity covers exactly one row of ten. The mechanics of what it does cover, and how much it costs in capacity, are in RAID levels explained.

Four of those rows deserve naming because they are the ones that actually happen in homes. Deletion is the most common, and it is usually a person rather than a machine. Ransomware encrypts every share the compromised client can write to, and a NAS exists specifically to be writable by every machine in the house. A controller, a cable or a failing power supply writing corrupted blocks puts garbage on the array, where parity dutifully protects the garbage; ZFS checksumming catches this and classic RAID does not. And theft, fire and flood take every drive at once, because every drive is in the same box in the same room.

The test is simple and worth applying to your own setup. If your NAS vanished tonight, which copy would you restore from, and where is it right now? If the answer is "the parity", or "the second volume in the same unit", or "the USB drive on the shelf underneath it", you have one copy in one room. Everything else on this page is detail.

What is 3-2-1-1-0, and do I need it?

3-2-1-1-0 adds two clauses: one copy offline or immutable, and zero errors on a verified restore. Neither costs hardware, both close a gap the original rule did not anticipate.

The extra one exists because of ransomware. In 1990 an offsite backup was a tape in a box, which is offline by construction. Today an offsite backup is frequently a cloud bucket or a second NAS reachable over a VPN, both of which are online, and anything online is reachable by a compromised credential. Offline means physically disconnected. Immutable means the storage itself refuses to overwrite or delete a version until a retention period expires, which object lock on cloud storage and locked snapshot schedules on a NAS both provide.

The zero exists because untested backups fail at an embarrassing rate: jobs that silently stopped months ago, a source path that changed, a target that filled up, an archive that needs a key nobody has, an encrypted volume with a forgotten passphrase. Zero errors means you have restored files and opened them, on a schedule.

For a home setup, the practical version of 3-2-1-1-0 is: array, local external drive, second external drive kept at another address, both externals unplugged when not running a job, and one restore test every few months where you pull a real file and open it. That is the entire modern rule, and it costs two drives and a calendar reminder.

Why does an always-connected USB backup drive not count?

Because ransomware does not care what you call a volume. It encrypts everything the compromised machine has write access to, and a USB drive permanently mounted to the NAS is exactly that: a writable path, indexed, mounted, ready. The same is true of a network share mapped as a drive letter on a Windows client, which is how home NAS units usually get encrypted in the first place, through a PC rather than through the NAS.

An always-connected external drive still covers a lot, so keep it. It covers the array dying, a double drive failure, a corrupted volume and an update that eats the pool. It does not cover the scenario people specifically buy it for. Four ways to close the gap, in increasing order of effort:

• Unplug it between runs. Crude, free, completely effective. A drive in a drawer cannot be encrypted over a network.
• Rotate a pair. Two identical drives, one connected, one at another address, swapped on a schedule. This satisfies the offsite clause and the offline clause simultaneously, which is why it is the recommendation on this page.
• Use snapshots with retention locking on the NAS itself, so previous versions cannot be deleted or overwritten by any client, only expired by the schedule.
• Push to object storage with object lock for the copy you cannot replace, using credentials that are write-only where the platform allows it.

One related hardening note, because it is where most home compromises start: the NAS should not be exposed directly to the internet. Turn off port forwarding, use a VPN for remote access and unique credentials with two factor authentication on the administrative account. Our NAS security hardening guide covers the settings in order of how much they matter.

How big does my backup target need to be?

Size the target against the data you actually hold, not the capacity of the array. A 24 TB array holding 9 TB of files needs a target above 9 TB with headroom, not one above 24 TB. Getting this wrong in the expensive direction is the most common budgeting error in backup.

The headroom exists for two things: versions, because keeping a year of daily and weekly versions of changing files costs space beyond the current size, and growth, because home libraries grow. A practical pair of multipliers is 1.5 times current data for the local target, which comfortably holds a year of versions of a mostly static media library, and 1.2 times for the offsite copy, which typically keeps fewer versions.

Worked from 9 TB of data today growing at 25 percent per year, which is a typical rate for a household media and photo library. Put your own figures, retention policy and growth rate into the 3-2-1 backup sizing calculator, which sizes all three copies at once.

Two adjustments to that arithmetic. If your data is mostly large media files that never change after they are written, versions cost you almost nothing and 1.2 times is enough locally. If it is documents, virtual machine images or anything a program rewrites daily, versions dominate and 1.5 times can be optimistic; deduplicating backup software is what keeps that in bounds. And remember the units: an 18 TB drive presents as 16.37 TiB once the operating system counts it in binary tebibytes, which is not a fault and is explained in the TB against TiB chart.

What does a backup target cost per terabyte?

Cost per terabyte is the only fair comparison across targets that differ by a factor of four in capacity. Here is every external target we have a verified listing for.

Sorted cheapest per terabyte first. The pattern is the same as internal drives: capacity below about 8 TB is poor value, and the floor sits in the 16 TB to 20 TB range. Prices are live listing prices at verification and move constantly.

Now the same comparison across classes of target rather than individual products, which is where the cloud arithmetic becomes visible.

Cloud figures are published list prices for object storage at roughly $5 to $7 per terabyte per month, compounded over five years, and exclude retrieval and egress charges, which is the line item people meet for the first time during a restore. Consumer flat-rate plans price per machine rather than per terabyte and frequently exclude network attached storage, so read the terms before assuming your NAS is covered.

The conclusion is not "never use cloud". It is match the target to the value of the data. Bulk media that could be re-acquired belongs on drives, at roughly $30.09 per terabyte once. Photos, documents, scans and anything irreplaceable belongs in both, because the extra cost of putting 2 TB of genuinely unique data in the cloud is small and it is the only copy that survives losing the building.

Backup drives by the job they do

Beginner Portable, no power brick

Western Digital

WD My Passport 5TB Portable Hard Drive

$225.50

Bus powered, so the whole offsite copy fits in a coat pocket. That portability is the point of the third copy.

Best for: The offsite rotation copy you keep at work or at a relative’s house.

Check price

Intermediate Best value per terabyte

Seagate

Seagate Expansion Desktop 8TB External Hard Drive

$274.23

Desktop drives need mains power but cost far less per terabyte than portable units, and a backup target does not need to move often.

Best for: The local second copy sitting next to the NAS.

Check price

Expert Largest single unit

Western Digital

WD Elements Desktop 20TB External Hard Drive

$700.35

One drive that can hold an entire mid-sized array. The risk is concentration: 20 TB of backup on a single unprotected spindle.

Best for: Large arrays. Buy two and rotate them rather than trusting one.

Check price

Prices change often, confirm on Amazon. As an Amazon Associate we earn from qualifying purchases.

Two practical notes on the hardware. A portable bus-powered drive is the right shape for the copy that travels, because it needs no mains socket at the other end, and it should be encrypted since it spends its life outside your house. And if you would rather not pay the enclosure tax repeatedly, bare internal drives such as the Seagate IronWolf 8TB plus a dual bay USB dock gives you the same storage with swappable media, which is closer to the tape rotation the rule was written for. Store the spare drives in antistatic drive cases, not loose in a drawer.

How many versions should I keep, and for how long?

A backup with no versions is a mirror, and a mirror faithfully copies your mistakes on schedule. If the only backup runs nightly and overwrites itself, a file corrupted on Tuesday is corrupted in the backup by Wednesday morning. Versioning is what turns a copy into a backup, and retention is how far back you can reach.

A retention schedule that works for a home NAS without eating the target:

• Hourly snapshots kept for 24 hours on the NAS itself. Cheap on a copy-on-write filesystem, and it covers the "I just saved over it" case within seconds.
• Daily versions kept for 30 days on the local backup target. This is the window in which most mistakes are noticed.
• Weekly versions kept for 3 months, which catches slow corruption and things nobody opened for a while.
• Monthly versions kept for 12 months on the offsite copy. This is your protection against a problem introduced long ago and discovered late, which is exactly how ransomware with a delayed trigger and silent bit rot both present.

Snapshots on the array are not a substitute for any of that, because they live on the same volume as the data. They are extremely useful as the first line, since restoring from a snapshot takes seconds, and they disappear with the pool. Treat them as convenience, not as a copy.

How do I know the backup actually works?

By restoring from it, on a schedule, and opening what comes back. This is the zero in 3-2-1-1-0 and it is the step that separates people who have backups from people who have backup software.

A restore test that takes fifteen minutes, every few months:

1. Pick a file you did not choose in advance, ideally one from several months back rather than yesterday, and one large enough to be inconvenient.
2. Restore it from the offsite copy, not the local one. The local one is the one that works. The offsite one is the one you are testing.
3. Open it. A restored file that will not open is a failed test, and archive-level corruption only shows up this way.
4. Restore a whole folder to a different location once a year, and check the file count and total size match.
5. Write down what you did and when. Along with where each copy lives, which credentials or passphrases it needs, and who else knows them.

The last point is not administrative padding. An encrypted offsite drive whose passphrase exists only in your head is not a backup for your household, it is a backup for you. Store the recovery information somewhere a second person can reach it, in a password manager with an emergency contact or in a sealed envelope with the drive's location written on it.

Also check that the jobs are still running. Backup software fails quietly: the schedule stops after an update, a source path is renamed, the target fills up. Turn on failure notifications and treat a week of silence from a job that should report success as a fault.

What should a home 3-2-1 setup actually look like?

Three concrete versions at three budgets, all of which satisfy the rule.

• Minimum, about $500. The array as copy one, a Seagate Expansion 8TB as the local target plugged in only while a job runs, and a WD My Passport 5TB holding just the irreplaceable files, living at another address. Two media locations, three copies.
• The one most people should build, about $1,230. Two WD Elements 18TB drives, identical, one connected during scheduled runs and one at a relative's house or an office desk, swapped every few weeks. Add cloud object storage for the few terabytes that are genuinely unique.
• Large library, about $1,315 plus cloud. A WD Elements 20TB as the local target with a versioned schedule, an 18 TB drive rotating offsite, and object storage with object lock for photos and documents. At this size a second NAS at another address starts to make sense if you want the offsite copy to be automatic rather than a habit.

Whichever you build, the array itself still wants parity, a correctly sized UPS so a power event never lands mid-write, and drives chosen on the specifications that matter rather than the brand. Those three protections are independent of backup and of each other, and you want all of them.

Related reading

• 3-2-1 backup sizing calculator to size all three copies from your own data and retention
• Best external hard drive for NAS backup for the picks by capacity
• RAID levels explained for what parity does cover and what it costs
• NAS against cloud storage for the running cost comparison in full
• NAS security hardening because most home ransomware arrives through a client, not the NAS