Build a backup routine that can survive ransomware

Define what must come back

List your important files and applications. Decide how much recent work you can afford to lose and how long you can operate without them. A file backup protects documents; an image backup can help restore an operating system, but still needs a tested recovery procedure and compatible hardware.

The familiar 3-2-1 idea means three copies including the working copy, on two storage types, with one copy elsewhere. Also think about separation from the credentials and systems ransomware might reach. Merely having three folders on one disk does not provide that separation.

Make a free-software plan with existing storage

1. Select the folders or machine image you need. Include application data, not just the desktop.
2. Use a built-in backup function or a free tool suitable for the workload. UrBackup is an example for managed client backups but requires a server and storage.
3. Schedule a backup interval based on acceptable data loss. A daily backup can still lose today's changes.
4. Keep a separate copy disconnected or otherwise protected from ordinary device access. Reconnect an offline drive only for the planned backup and verification process.

If you do not own sufficient storage, a completely cost-free full backup may not be possible. Cloud storage trials and usage-based free tiers are not unlimited permanent free capacity.

Practise a small restore

Create a harmless document with a date in it, run the backup, then restore it to a different folder. Compare its contents with the original. Next test a file from an older retained backup. This checks whether version history actually supports recovery from corruption discovered late.

For image backups, create and boot the rescue media in a controlled test. Document where the backup lives, the credentials needed and which disks would be overwritten. Do not practise destructive restoration on the only working computer.

Verify the routine

Check job completion, retained restore points, available storage and the restored sample. A green job result is useful but not sufficient on its own. Set a reminder or existing monitoring alert to notice missed backups before an incident.

Common mistakes

RAID improves availability in certain failures; it is not a separate backup. Sync can copy deletions or encrypted versions. An always-connected writable USB drive may be encrypted with the computer. Incremental backups save time and space but may depend on an intact chain; test the tool's restore process.