Photo backup: the 3-2-1 rule in practice
Photos rarely vanish because a drive died. They vanish because you assumed there was a backup: the sync folder dutifully synced a deletion, the external drive sat unpowered for three years, or the backup ran every night and nobody ever restored from it.
1. What 3-2-1 means
Three copies, two kinds of media, one offsite. An old IT rule; each clause guards against a different accident.
| Clause | Protects against |
|---|---|
| Three copies | Accidental deletion, overwriting, single-file corruption |
| Two media | A whole batch of identical drives failing together |
| One offsite | Fire, theft, flood, losing the entire machine |
A copy only counts if no single action can take it out along with the others. By that test, two popular "backups" aren't.
- RAID survives a dead drive, not a deleted or overwritten file. Delete once and the file is gone from every disk at the same moment.
- A sync folder deletes in the cloud when you delete locally. Only with version history or a retained trash switched on, and the retention period checked, does it start to qualify as copy three.
2. Import: naming and folders
- Folders by date, not subject:
2026/2026-09-02_dali-erhai/. A frame can be landscape, travel and a particular lake at once, but it has one capture date. Subjects go in keywords. - Date first in the filename.
20260902_erhai_0137.ARWsorts correctly anywhere. Keep the camera's original number as a suffix so any file traces back to the card. - Avoid
/ \ : * ? " < > |, and spaces where you can. They cause the most grief in cross-platform syncing and on the command line. - Do it at import. Five minutes now or five hours later, and later rarely happens.
Most import software renames in bulk. For batch jobs in general, see batch watermarking.
3. What to keep and what to delete
| Type | Keep? | Why |
|---|---|---|
| RAW originals | All of them | Not reproducible. What you won't edit today you may want in three years. See RAW or JPEG |
| .xmp sidecars and catalogue files | Must be backed up too | Every edit decision lives here; lose them and the editing is gone |
| Finished JPEG / TIFF | Keep | Re-exportable from RAW, so lower priority |
| PSD and other working files | As needed | The largest files; keep only what you will revisit |
| Obvious rejects (missed focus, accidental frames, duplicate bursts) | Delete on import day | The longer you wait, the harder it gets |
4. Where the three copies live
| Copy | Location | Character |
|---|---|---|
| 1 | Working drive: internal or external SSD | Fast, always editable, and the most exposed to mistakes |
| 2 | Local high-capacity drive or NAS | Spinning disks are cheap; power it up to back up |
| 3 | Offsite: cloud, or a drive at the office or a relative's | Rotate it quarterly |
Don't get pedantic about "two media". What matters is that the three copies don't share one machine, one room or one account. Three drives in one computer can die together in a single power surge or one mistaken format.
5. Verification and restore drills
The usual failure is a backup that runs every night and has never been checked.
- Verify. Hash after copying:
certutil -hashfile FILE SHA256on Windows,shasum -a 256 FILEon macOS and Linux, or a sync tool with verification built in. Interrupted copies and silent bit rot both show up here. - Practise restoring. Once a quarter, pick a folder at random, restore it and open the files. Plenty of people learn on the day they need it that the drive is empty or unreadable.
- Power the drives up. Hard disks left unpowered for years and SSDs left unwritten for years can both fail. When the offsite copy rotates back, read the whole disk once.
- Export the catalogue separately into the backup. It is orders of magnitude smaller than the photos and the hardest thing to rebuild: lose it and every rating, collection and edit is gone while the images survive.
6. FAQ
Does a cloud sync folder count as a backup?
Not by default. Syncing keeps both ends identical, so a local deletion goes up to the cloud. It only works as the third copy with version history or a retained trash on and a known retention window, often 30 to 90 days.
Does RAID count as one of the copies?
No. RAID keeps a system running through a drive failure. It protects hardware, not files: deletion, overwriting, ransomware and losing the machine hit every disk at once. You still need real backups on top.
How long should I keep RAW files?
Forever, if you can. Storage gets cheaper every year, and the space saved by deleting RAWs is small next to wanting to re-edit a frame and finding only a JPEG. To free space, start with PSDs and other working files and with duplicate bursts.
What about the photos on my phone?
Same rule. The phone is one copy and the auto-synced cloud library another, but that is still syncing. Export to a computer or drive now and then to earn the third, and mind the location data when you do; see what is hidden in a photo.