Almost everyone who loses data had a backup. It had stopped running months earlier, or it was on the drive that failed, or nobody had ever tried to restore from it.
The plan below is the standard 3-2-1 rule made concrete on Windows. Checked on Windows 11 24H2.
3-2-1: three copies of your data, on two different types of storage, with one copy offsite.
Step 1: File History for the files you create
Plug in an external drive, then go to Settings > System > Storage > Advanced storage settings > Backup options.
Turn on File History and add the folders that matter. By default it covers Documents, Desktop, Pictures, Music and Videos. Add anything that lives elsewhere - a projects folder on another drive is exactly the thing people forget.
Leave the frequency at hourly. Set retention to Until space is needed unless you have a reason not to.
This protects against the everyday case: you deleted or broke a file and want yesterday’s version.
Step 2: A full system image
File History does not restore Windows itself. For that you need an image - a block-level copy of the whole drive.
Windows still ships the legacy tool: Control Panel > Backup and Restore (Windows 7) > Create a system image. It works and it is free. It is also deprecated, awkward, and cannot do incremental images well.
If this machine matters, a third-party imaging tool is the better answer - most have a free tier sufficient for one PC. Whichever you use, the requirement is the same: the image must live on a different physical drive from the one being imaged. An image stored on the drive it backs up protects you from nothing.
Step 3: One copy that is not in the building
This is the copy that survives theft, fire, and ransomware that encrypts every drive it can reach.
Two workable options:
- Cloud sync with version history - OneDrive, or any provider that keeps previous versions. Sync alone is not backup, because deletions propagate; version history is what makes it count.
- A second external drive kept elsewhere - rotated monthly. Unglamorous, cheap, and immune to anything that happens over the network.
The 3-2-1 rule does not care which you choose. It cares that one copy is not reachable from the machine being protected.
Step 4: Prove it works
This is the step everyone skips, and it is the only one that proves the rest.
- Restore one real file from File History. Right-click a file > Show more options > Restore previous versions. Open the restored file and confirm the contents are what you expect.
- Verify the image is readable. Most imaging tools have a Verify or Validate function. Run it. If yours does not, mount the image and browse it.
- Retrieve one file from the offsite copy, from a different device if you can. This tests the credentials as well as the data - a backup you cannot sign in to is not available to you.
Write the date on the calendar and repeat every three months.
The failure modes this catches
- Backup silently stopped weeks ago - caught by the restore test, invisible otherwise.
- Backup drive is failing - caught by verification.
- Backup is running but excluding the folder you actually care about - caught the moment you try to restore a real file.
- You cannot get into the cloud account - caught before it matters.
What to do right now
If you do nothing else today: plug in an external drive, turn on File History, and restore one file from it. That is a working backup of your documents and it takes about fifteen minutes. The image and the offsite copy can wait for the weekend.
Questions people also ask
Is OneDrive a backup?
Partly. It is sync, which means a deletion or a ransomware encryption propagates to the cloud copy. OneDrive keeps version history and a recycle bin that can recover from that, but only within a retention window. Treat it as one copy in a 3-2-1 plan, not as the whole plan.
How often should I back up?
Ask how much work you are willing to redo. If losing a day is acceptable, daily is enough. If losing an hour is not, you need continuous or hourly - File History defaults to hourly, which suits most people.
Do I need a full system image if I have file backups?
Not to protect your data, but it changes how long recovery takes. Files-only means reinstalling Windows and every application before you can work; an image means restoring and carrying on. For a work machine, that difference is usually worth the disk space.
Will a backup drive left plugged in be hit by ransomware?
Yes, that is exactly what modern ransomware looks for. This is the argument for one copy that is offline or offsite, and it is why an always-connected external drive should not be your only backup.
How long do external drives last?
Plan for three to five years for a spinning drive in occasional use, and treat any drive as capable of failing without warning. This is a reason to have two copies, not a reason to buy an expensive drive.