Part 1 of 3: Why one backup of your family photos isn't a backup

This is the first of a three-part series on backing up family photos and videos. Part 1 covers the basic rule and why it exists. Part 2 will cover the hard-drive side of the setup, and Part 3 will cover the cloud side.

If you've got a decade or more of family photos and videos, and someone asked you right now where they all live, what would you say? Most people say something like "they're on my phone" or "they're in iCloud" or "I copied them to an external drive a couple years ago." Each of those sounds reasonable. None of them is a backup.

A backup isn't a copy of your photos. A backup is a copy of your photos that survives the thing that took out the original. That's a real distinction, and once you see it, you can't unsee it.

The 3-2-1 rule

People who do this for a living follow a guideline called 3-2-1, and it's been around long enough to be boring, which is exactly what you want in a backup strategy. The rule says you should have three copies of every photo, stored on two different kinds of storage, with one of those copies kept somewhere other than your house.

Each piece of that rule is there for a specific reason. Three copies, because one copy is the original and a second copy can fail right alongside it — drives die in pairs more often than you'd think, and a single bad sync can wipe out both at once. Two different kinds of storage, because a problem that hits one technology — a bad hard drive batch, a cloud provider outage, a software bug in the sync tool — probably won't hit the other at the same time. And one copy offsite, because a house fire, a flood, a break-in, or a ransomware infection doesn't care how many drives you owned if they were all sitting in the same room.

That's the whole rule. The rest of this series is just how to set it up without it being a hassle.

Three setups that feel safe but aren't

Before getting to the how, here's what most people are doing today and what each setup doesn't protect against. None of these are stupid, but each one has a specific failure mode that takes everything down.

Phone-only

The photos are on the phone, and that's it. Maybe they get synced to a laptop once in a while, maybe not. One drop in the lake, one stolen phone, one cracked screen that won't power on, one phone left in an Uber, and ten years of pictures are gone. Phones are cameras that happen to hold their pictures temporarily, not storage.

iCloud-only (or Google Photos-only)

This one feels safer because the photos are "in the cloud," and for the most part the cloud is reliable. But you don't own the photos in iCloud — you own access to them, and that access depends on an account staying in good standing. A lockout from a forgotten password, a security flag, a billing card that expired while you were on vacation, or a family member changing settings without telling you leaves the photos sitting somewhere you can't reach them. They're also gone if the account gets compromised and the attacker deletes the library. One account, one point of failure.

One external drive in the desk drawer

This is the setup people feel best about, because they took the trouble to buy a drive and copy stuff to it. And it is genuinely better than the first two. But it's still one copy of the photos, in the same building as the originals. A house fire, a burglary, or a flooded basement takes both the drive and the originals together. And ransomware, if the drive happens to be plugged in when it hits, takes both at exactly the same moment. One drive in one location is a copy, but it isn't a backup in the sense that matters.

Where this is going

If you recognized your own setup in one of those three, that covers almost everyone who hasn't specifically sat down and thought about this. The fix isn't expensive and it isn't complicated, and once it's in place you mostly stop having to think about it.

Part 2 will cover the hard-drive side of the setup — what to buy, how to organize it, and how to keep a second drive in sync without making it a weekly chore. Part 3 will cover the cloud side, including which services to trust for this and how to use them so that an account problem doesn't lock you out of your own pictures.