Copying important files to an external hard drive or the cloud does not mean a backup is complete. A backup must allow data to be restored to a previous state if ransomware or mistakes damage it, one expert warned.

On Oct. 10, Japanese outlet Gigazine reported that software engineer Aleksandar Filipovski (알렉산다르 필리포프스키) explained on his personal blog why backup systems need to be designed properly and tested for recovery.

Filipovski said he nearly lost family photos after moving them from a PC to a single external hard disk drive. The file list was erased when his father formatted the drive for a TV set-top box. The photos were restored, but the incident made him realise the risks of keeping data in only one place.

Even if data is copied to a separate device, synchronising it with the original can mirror accidental deletions or ransomware damage. RAID1, which writes the same data to two disks, also cannot replace a backup that restores an earlier state. That is why 'snapshots' that preserve data at a specific point in time are needed.

Backup intervals should be set to match the recovery point objective, or RPO, which defines how much data loss is acceptable. Filipovski cited the 'GFS' method as an example, keeping 14 days of daily backups, 7 weeks of weekly backups and 12 months of monthly backups. It preserves recent data more frequently while keeping older data at wider intervals. Storage space and transmission costs can also be reduced by avoiding duplicate storage of unchanged files.

Storage locations should also be distributed. A common approach is the '3-2-1 rule', which keeps 3 copies of data on 2 types of media, with 1 stored in a different location. On servers, file access permissions and the consistency of database records should also be checked.

In cloud storage such as Amazon S3, file permissions and ownership information may not be preserved automatically, and request costs can also rise when large numbers of small files are transferred.

If building a system directly becomes too complex, specialised tools such as BorgBackup or Restic can be used. Filipovski recommended testing every six months whether backups can actually be restored. What matters is not the existence of copies, but whether data can be recovered when needed.