What Is a 3-2-1 Backup Strategy and How Should Photographers Use It?

The topic of safely backing up your photos is a popular one on this site. Every time I write an article that touches on the subject, it always gets a lot of traffic and shares on social media. I must have a smart audience, because backing up your photos is an incredibly important part of being a photographer!

Many photographers incorrectly start out by not caring about their photography backup routine. One of the big reasons for this is that people spend all of their budget on a new camera and lens, and never give a second thought to how they are going to keep their photos safe. Then at some point they either experience catastrophic image loss themselves, or hear a story about it from a friend. Sadly the photo world is rife with examples of people losing every image they every created, simply because they were poorly informed or lazy with their photo backups.

I have written about this cycle before in the article called: The Mindset That’s Costing People Their Images: Digital Photography Is Not Free! It’s a good companion piece to this article and I’d recommend having a read of it.

In this article I’m going to explain what is known as the 3-2-1 backup strategy. The origins of the name will become apparent when it is explained. This strategy should be seen as an absolute minimum level of protection for your photos. If you are not using a 3-2-1 backup strategy, you’re walking on thin ice! It could crack at any moment, and you could easily lose your photos.

Explaining the 3-2-1 Backup Strategy

Since this is a photography website I’m often going to use the word photos instead of files, but of course this strategy and advice can apply to any digital file.

A 3-2-1 backup strategy means that you have a total of three copies of your photos. Two of which are local (at home or in your office), but on different devices. One more copy is kept offsite.

Your First Copy

Once you have downloaded the photos from your memory card onto your computer or an external drive, this is your first copy. While it can be said that this is technically your second copy because one copy currently exists on your memory card, it would be a mistake to think that way. The copy on your memory card is always intended to be a temporary copy. You will always format that card at some point, and even if it’s not immediately, it’s all too easy to get confused about a pile of identical looking cards. The safest way to run your backup strategy is to ignore the copy on the card, and count the first downloaded copy as your first copy.

Your Second Copy

The second copy of your photo should be on a different device to the first copy. This means that you cannot simply duplicate the photo folder on your computer, or on the drive that you used for the first copy. This would not protect you from drive failure of that device.

Always remember that this second copy exists to protect you from hardware failure. This can be drive failure, or a failure of your computer, or a failure of the enclosure in which this second drive is installed.

The simplest way to tackle this is to place the first copy of your photo on your computer, and the second copy onto an external drive of some sort. Usually this external drive would be connected to the computer via USB or Thunderbolt, but it could also be a NAS (network attached storage).

If the internal drive on your computer is not large enough to hold the first copy of your photos, you are going to need two external drives. Drive 1 and Drive 2. They must be separate drives inside separate devices. In other words, you cannot use a RAID array at this stage to satisfy the requirement for two copies on two drives. I have written a subsection about why a RAID is not a backup further down the page. Please make sure you read it. It’s an area of this topic that often trips people up, with disastrous effect.

Once you have your two local locations, you need to make a decision as to how you are going to ensure that you have your files from Drive 1, backed up onto Drive 2. I firmly believe that it’s a mistake to think that you will do this manually. It’s far too easy to forget to do it, or just get lazy at the end of a long day. What you need is an automated system to make sure that Drive 2 is a perfect copy of Drive 1.

This is where a great piece of software called Carbon Copy Cloner comes in. I have used it for a decade, and I can’t recommend it highly enough (not an affiliate link). With CCC you create various automated backup “tasks” and schedule them to take place automatically. In just a few seconds you can use it to automate a clone of Drive 1 onto Drive 2, and set it to run every few hours, or every night. Whatever works best for you.

Now your process looks like this:

  • You take your photos, then bring home the memory card and ingest it onto Drive 1 using something like Lightroom to create a nice folder structure.
  • Every few hours, Carbon Copy Cloner (or other similar software) takes a look at the contents of Drive 1 and Drive 2, and copies over any files that are missing from Drive 2 to ensure it’s a perfect clone of Drive 1.

Since the application only copies over new files, it runs quickly in the background and you probably won’t even know it’s happening until it notifies you that the backup is complete. Now you have two copies of your photos on two different local devices.

Offsite Copy

There are several ways to ensure that you have an offsite copy of your files to comply with the final part of the 3-2-1 strategy. The most common way is to use a cloud storage service such as Google Drive, Dropbox, Amazon S3 or Backblaze. There are so many cloud storage services out there that it would be impossible to consider them all in this article, but I can make a few basic recommendations.

Cloud Backup

Cloud sharing services like Google Drive and Dropbox have a high cost per terabyte of storage. They are primarily designed as sharing services and don’t cater well to large and continuous backups of files. They might be suitable for the hobbyist photographer with a small photo archive – someone that already uses one of these services for other cloud storage.

For professionals or others that create much larger volumes of files, Backblaze is a great option. This is a dedicated backup service that uses a background application to continuously upload your files to a cloud account. You have complete control over when the uploads take place, as well as how much bandwidth they use. The idea is that once you have it set up, you never even know that it’s happening in the background.

In order for cloud backups to be a viable option, you need an internet connection with enough speed to ensure that your volume of created files is uploaded in a reasonable time. There’s no sense using such services if you are creating photos and videos faster than they can be uploaded. This will only result in a growing backlog, and your 3-2-1 plan will be shot to pieces.

Manual Offsite Backup

In some places, such as my home in the Canadian Yukon, unlimited internet bandwidth is now something that exists. I currently pay $150/month and that only gets me 300Gb of bandwidth! In such circumstances, cloud services for offsite backups are also a non-starter for most people.

If you have bandwidth limits, the best solution is to manually move a copy of your files to an offsite location on a routine basis. I personally keep a copy of my photo archive on a RAID array in a Pelican case that lives at a location some 30 miles from my house. Every couple of weeks, I retrieve the drive and bring it to my office. When it is plugged into my computer, Carbon Copy Cloner automatically recognizes it as my offsite drive and knows to begin the cloning process. Once all new files have been copied over to the drive, I return it immediately to the offsite location. Until we have better internet service in the Yukon, that’s my best bet. I know many other people around the world have to rely on a similar routine.

One thing to consider in this scenario is how far away your offsite location is. I specifically underlined that mine was 30 miles from my office location. Simply asking your neighbour to look after your offsite copy is not a good idea! Remember that this 3rd copy of your files is in place to prevent file loss from natural disaster and theft.

If your house is flooded, there’s a good chance you neighbour’s house will be flooded too. The same goes for fire, or even theft if a thief is targeting a neighbourhood. In some cases that are prone to extreme forest fires, such as Australia, it can easily be argued that your offsite copy should be much further away than 30 miles. Take the time to consider your own geographic situation, and history of local disasters.

Automated Offsite NAS Backup

There is a third option for offsite backup, and I would definitely label this one as PRO. It requires a considerable amount more technical knowledge than the other two options, and it’s also likely to be a lot more expensive. However, it is completely automated, and therefore provides a little more protection against human error or laziness.

If one of your local file copies exists on a network attached storage (NAS) device, this device will have access to an internet connection. Most mid to high-end NAS devices have a feature that will automate the duplication of your data onto a second remote NAS device that can be store in any offsite location, anywhere in the world.

If you have a QNAP or Synology NAS, and don’t mind investing in a second NAS to store at an offsite location, this is a really cool option. Perhaps you keep one NAS at home and one at your office. Or maybe one at your home office, and one tucked away in your friend’s home office. Offering them the same service in return.

A RAID is Not a Backup!

Many people misunderstand the purpose of RAID arrays, and it can cause disaster.

This topic needs its own subheading to draw attention to it. Having examined the backup routines of many photographers over the years, this is often an area where people go wrong.

When people first hear about RAID systems they fixate on the idea that most (not all) RAID systems duplicate your data over a series of drives. If you experience a drive failure within your RAID, your data is still protected and you can continue to access it. The simplest of RAID systems is called RAID1. With a RAID1 you can have as little as two drives. The RAID system duplicates the data from one drive onto the other drive automatically and simultaneously. If one drive fails, you still have access to your data on the other drive.

The problem is that many people mistakenly think that a RAID system such as this, can be called a backup. They will say things like “I have my photos backed up on my RAID. If one drive fails, it’s no problem, I have the photos on the other drive”.

This is a HUGE mistake!

There are two fundamental things to think about with this scenario. When you do think about them logically, you’ll see right away that a RAID is not a backup:

  1. The duplication of data on a RAID is instantaneous. If a file or series of files gets corrupted on one drive, the corruption is immediately duplicated onto the second drive. Now all copies of that file are corrupted.
  2. The duplication of actions on your files in a RAID is instantaneous. If you accidentally delete a photo, or folder of photos from the drive, this deletion takes place immediately on both drives. Your photos are gone.

In fact there are even more ways that I could explain how a RAID is not a backup. However, I think these two examples underline things in a clear enough way.

So what is a RAID for, if it isn’t a backup?

RAID systems are not, and never have been designed to be a backup in and of themselves. They are designed for speed and continuity of business. They use multiple drives because it allows data to be read simultaneously off these drives, making them faster than a standalone single drive. That’s the speed part. They also allow access to your files, even if one drive fails (apart from RAID0). That’s the continuity part.

A RAID can certainly be used as one step in your 3-2-1 backup strategy, but it is only ever a single step. It can’t ever be seen as more than one of your three necessary copies in the strategy. If you use a RAID in your 3-2-1 strategy, you will get the benefits of speed and continuity that I mentioned before, but you should never think of your photos as being “safer” on a RAID.

I have written an entire article about how a RAID is not a backup, where I go into even more detail. If it’s still not clear to you, please make sure you read it.

3-2-1 Backup Rule Examples

Let’s take a look at some correct examples.

Example 1

A photographer uses Lightroom to ingest the photos from his memory card onto the internal drive of his computer. Once the ingest has been completed, they copy that folder of photos manually onto an external USB drive. This photographer uses Backblaze to create a cloud backup of the entire contents if his computer’s internal drive.

This is a 3-2-1 backup strategy. The photos eventually exist in three places: Internal drive, external USB drive and on the Backblaze cloud. The photos are on two different local devices: Internal computer drive, and external USB drive. The third copy is offsite in the Backblaze cloud.

Room for improvement? Yes!

In the example I have described, the photographer is manually copying the photos onto the extrrnal USB drive to create his second copy. If they forgot to do that, they would put their photos at risk. It’s much better to automate that step in the process using software such as Carbon Copy Cloner.

Example 2

A photographer uses Photo Mechanic to download his photos onto an external Thunderbolt drive that’s attached to his computer. At night, Carbon Copy Cloner examines this primary Thunderbolt drive and compares its contents to a second external USB drive. It then copies all new files onto the USB drive. The photographer uses Backblaze to sync the contents of the external Thunderbolt drive to the cloud.

This is a 3-2-1 backup strategy. The photos exist in three places: On the Thunderbolt drive, on the USB drive and on the Backblaze cloud. They exist in two different local locations: The Thnderbolt drive and the USB drive. The third copy is offsite in the Backblaze cloud.

Room for improvement? Depends…

Cloud backup is a fine way to ensure you have an offsite copy of your files, as long as your internet has a fast enough connection to avoid a bottleneck. If you shoot photos faster than they can be uploaded to the cloud, you have a problem. Some monitoring of the Backblaze upload queue would be necessary until you are confident that it can keep up.

Example 3

A photographer uses Capture One Pro to download photos from their memory card onto a RAID array that is connected to their computer. Every two hours, Carbon Copy Cloner software writes new files onto an external USB drive – USB1. Every Friday, the photographer takes this USB1 drive and moves it to an offsite location – a friend’s house that is many miles away. When they drop off the USB 1drive, they pick up another similar USB drive – USB2 – from their friend’s house and bring it back to their office. Once this drive is connected to their computer, Carbon Copy Cloner recognizes it and compare its contents to the RAID array that is connected to the computer. Any new files are automatically copied to USB2.

This is a 3-2-1- backup strategy. The photos exist (eventually) in three places: One copy on the RAID array, one copy on USB1 and one copy on USB2. There are two local copies of the photos: One on the RAID array, and one on USB2. A third copy exists on USB1 at an offsite location.

Note that in this scenario where the USB1 and USB2 drive are constantly swapped back and forth, the location for the third copy would also swap back and forth between being on USB1 and USB2. Not a problem, just something to take into account.

Could it be improved?

In this scenario the photographer has to manually move his files to an offsite location because his internet doesn’t offer enough bandwidth to use cloud backup for the offsite copy. We’re assuming this is simply a factor of their location. If you wanted to get picky here, you could say that the photographer should perform the offsite drive swap more often than once a week.

I would say this this is highly dependant on the photographer’s shooting schedule. If they shoot in a studio with multiple daily clients, yes it could be improved. If they are a commercial photographer that does one or two huge shoots every month, it’s probably not necessary. But it would be good to perform that offsite drive exchange immediately after a big job, instead of waiting for the weekly slot. This tends to be the approach that I take with my own offsite drive swap.

3-2-1 Backup Strategy Fails

Now let’s take a look at some common scenarios where photographers have tried to set up a good backup routine, but missed the mark when it comes to satisfying the 3-2-1 rule.

Example 1

The photographer ingests their photos from the memory card onto a direct attached storage (DAS) RAID array such as a Drobo or a G-Technology G-RAID. They also use Backblaze to back up the contents of the DAS onto the cloud.

This is NOT a 3-2-1 backup strategy!

In this case the photographer has misunderstood the purpose of a RAID array and they think that it is a backup of their photos because if a drive fails, they can still access their photos.

Let’s run though a possible scenario: The photographer accidentally deletes a folder of photos on their DAS, and this happened before Backblaze had time to upload those photos to the cloud. If those photos are not in a trash can, they are now gone! The Drobo does not keep two copies of the folders. If you delete them, or corrupt them, they are gone from the device. Period.

In most configurations of offsite cloud backups there is also a time limit for how long deleted files are stored. Even if the Backblaze upload had occurred before the files were deleted from the DAS, they could then be deleted from Backblaze as well. There’s a window of time where they will still be available, but this window of time is sometimes dependant on the type of plan you are paying for with your cloud backup service.

This is a key thing to understand with your chosen cloud backup service. What happens to the files on the cloud, if the local versions of those files have been deleted? Remember, I’m using Backblaze as one example, but there are several others and they might all handle this process differently.

Example 2

This photographer is a Mac user. They use Lightroom to import their photos onto the computer’s internal drive, and they use the Mac’s native Time Machine function to keep a backup of the internal drive on an external USB drive.

This is not a 3-2-1 backup strategy!

The first copy of the photos exist on the computer’s internal drive. The Mac’s Time Machine function does create a backup of these photos on the external USB drive. There are two copies, on two local devices, but the photographer has no offsite copy.

One day their dog knocks over a candle in the living room while they are in another room, and the house is burnt to the ground. Without an offsite copy of the photos, the photographer has lost everything.

In fact there’s another more nuanced issue with this particular backup strategy, and it comes from using the Time Machine function on a Mac. Although Time Machine actually does a great job of keeping a backup of the files on your computer, the design is primarily there to help you recover accidentally deleted files. When the Time Machine drive is plugged into your computer, you can scroll back though a timeline of files on the drive to find anything that you have lost.

But what happens if your computer is broken, or the internal hard drive of the computer has failed? Yes you do have a backup of your photos on the Time Machine drive, but you now have no way to easily access them. Time Machine backup files do not have a normal, simple file structure on a hard drive. You cannot simply plug the drive in and expect to be be able to browse or edit those photos in software such as Lightroom. In other words, a hardware failure like this will give you continuity of business issues. You will likely need to fix or replace your computer first, before having easy access to your photos again.

This might not be a problem if you are a hobbyist. Perhaps you can wait a few weeks. But it probably would be a problem if you were running a photo business and you had client photos on the Time Machine drive that need processing.

For this reason I generally do not recommend using Time Machine as part of a photo backup routine. It’s much better to use cloning software such as Carbon Copy Cloner, because this leaves your photo backups in exactly the same folder structure on the backup drive, as they were on the original location.

Wrap Up – Why Risk It?

A 3-2-1 backup strategy is the absolute bare minimum photo backup system that should be used to ensure your photos are protected from hardware failure, human error and natural (or criminal) disaster. If you don’t operate a 3-2-1 strategy, you’re playing Russian roulette with your hard earned photos. More than likely, it’ll end in disaster at some point. Why risk it?

Hopefully the explanation of the strategy can be a useful blueprint for setting up your own robust photo backup system. There are also many additional linked articles throughout the post, and in the recommended reading section below that expand on some of these topics.

If you want to see all the details about my own 3-2-1 backup strategy, you can find that in the my ongoing series entitled: My Backup Routine. This series of posts details my current setup, as well as all of the previous iterations of my setup over the past several years. As time and technology marches on, I have experimented with different systems. You can use that post series to learn from my own mistakes, and quickly get up to speed on the best systems on the market right now.

If you have any backup related questions, leave them in the comments! Always happy to help people protect their hard work.

Photo of author

Dan Carr

Professional photographer based in Yukon, Canada, and founder of Shutter Muse. His editorial work has been featured in publications all over the world, and his commercial clients include brands such as Nike, Apple, Adobe and Red Bull.

You may like

4 thoughts on “What Is a 3-2-1 Backup Strategy and How Should Photographers Use It?”

  1. I’d argue that besides natural disaster you should also consider malware and ransomware in your backup plan. Ransomware may come into your computer or network from something you shouldn’t have downloaded or because of vulnerabilities in software or network security setup or in combination with someone else on the network acting insecurely. Lots of large companies and organizations have fallen prey, but smaller business and home users get targeted, too. Hacker groups even offer Ransomware as a Service (RaaS) so every criminal opportunist in the world can get in on the action without a lot of startup cost or technical ability. I’d argue it’s just as likely, maybe more likely, to be hit by ransomeware than to have a natural disaster.

    Do you really want to pay 2 bitcoin or send $800 in gift certificates to an anonymous hacker to get your files decrypted so you can use them again? Or if your assets are really valuable then the price might go up even more. Even if you do pay, they may not always decrypt correctly and are these hackers the person you really want to support by being unprepared and paying them?

    They begin by encrypting all the files on your computer’s hard drive and all connected drives. If your backup is always attached to your computer or it’s a mapped network drive then your backup gets encrypted, too. If your magic cloud backup just mirrors all the changes on your file system, then it could be encrypted, too, before long. (though some cloud services keep some number of older versions of files, it’s not universal.)

    In a case like this, an actual off site backup that is not always connected to your computer or synced all the time will be more useful and more secure (and probably cheaper) than a trendy cloud service that synchronizes super frequently.

    • You’re right. I probably need to address this in its own section. My QNAP NAS uses Snapshot versioning to protect against ransomware, so you can roll back to a previous pre-encrypted version.

      Thanks for the reminder to add this to the article, though. I do agree that this is something people have to be worried about these days.

      What is your own system to protect agains this?

    • Sorry Bob, I can’t make a specific recommendation because I don’t use Windows. I could Google “CCC Windows alternatives” but since I would have no actual experience of the application, it can’t be called a recommendation. I’m sure there is something out there, but you’ll have to do some research.


Leave a Comment

Your email address will not be published or shared. Please note that if you include a link in your comment, it will have to be moderated first before it appears on the site. Required fields are marked*

By submitting a comment this form also collects your name, email and IP address so that we can prevent spam. For more info check our privacy policy.