Lesson 5 of 5 · 7 min
Backups, recovery, and when to ask for expert help
The 3-2-1 backup rule, how Time Machine applies it on a Mac, and two organizations that help people at real risk.
Every layer in this course reduces the chance of a bad outcome; none of them reduces it to zero. This final lesson covers what happens if something still goes wrong: losing a device, having files corrupted or deleted, or simply needing help from people who do this for a living.
The 3-2-1 rule
The US Computer Emergency Readiness Team’s guidance on data backups, published through CISA, sets out a simple rule that still holds: ‘3 – Keep 3 copies of any important file: 1 primary and 2 backups. 2 – Keep the files on 2 different media types to protect against different types of hazards. 1 – Store 1 copy offsite (e.g., outside your home or business facility).’ The same guidance notes why a single backup on the same drive as the original falls short: if that drive is damaged, stolen or corrupted, the original and the backup can be lost together.
Applying it with Time Machine
On a Mac, Time Machine is the built-in way to keep the ‘2’ and part of the ‘1’ in that rule. Apple explains it ‘automatically backs up your Mac and performs hourly, daily, and weekly backups of your files’, and specifically recommends backing up ‘to a location other than your internal disk, such as an external hard disk, a disk on your network, or a Time Capsule.’ That external disk is the second media type; adding a cloud backup, or periodically rotating a drive to somewhere off-site, is what fulfills the third part of the rule, an offsite copy.
- Keep the working copy, an external backup, and at least one offsite or cloud copy, not just two copies on the same desk.
- Encrypt any backup drive that leaves the house, the same way FileVault protects the Mac itself.
- Periodically confirm a backup actually restores a file; a backup nobody has tested is a guess, not a guarantee.
When the answer is expert help, not another setting
Everything in this course is general guidance. For journalists, activists, human rights defenders and their sources facing a specific, capable adversary, there is a point where the right next step is a person, not a checklist. Access Now runs a Digital Security Helpline that, in its own words, works ‘with individuals and organizations around the world to keep them safe online’, offering emergency response, personalized guidance, and support in multiple languages, available at [email protected].
Freedom of the Press Foundation focuses specifically on journalists and their sources, describing its aim as helping ‘all journalists, from security novices to reporters working in the most high-risk environments’, through training, direct security advice, and organizational security reviews rather than one-size-fits-all recommendations.
Key takeaways
- The 3-2-1 rule: 3 copies of any important file, on 2 different types of media, with 1 copy kept offsite.
- A backup stored on the same drive as the original can be lost together with it if that drive fails, is stolen, or is corrupted.
- Time Machine covers the local backup and can help with an offsite copy, but the offsite and cloud parts of the rule still need a deliberate choice.
- An untested backup is a guess; periodically confirm that a real file can actually be restored from it.
- Access Now’s Digital Security Helpline and Freedom of the Press Foundation both offer tailored expert help for people facing a specific, serious digital risk.
Check yourself
1. What does the 3-2-1 backup rule recommend?
- 3 backups on the same external drive
- 3 copies of a file, on 2 different media types, with 1 copy kept offsite — Right.
- 1 copy is always enough if it is encrypted
- 2 copies on the same computer, updated 1 time per year
The rule is 3 total copies, across 2 different media types, with at least 1 of those copies kept offsite.
2. Why does keeping a backup on the same internal drive as the original fall short of the rule?
- It takes up too much disk space
- If that drive is damaged, stolen or corrupted, both the original and the backup can be lost together — Right.
- It is not compatible with Time Machine
- It requires an administrator account
A backup on the same physical drive shares the same risk of loss as the original file it is meant to protect against.
3. What does Apple recommend for where a Time Machine backup should be stored?
- On the same internal disk as your files
- A location other than your internal disk, such as an external hard disk or a disk on your network — Right.
- It does not matter where, since Time Machine encrypts everything automatically
- Only in iCloud, never on a physical drive
Apple specifically recommends backing up to a location other than the internal disk, such as an external drive or a networked disk.
4. Who does Access Now’s Digital Security Helpline primarily serve?
- Only paying corporate customers
- Individuals and organizations around the world who need help staying safe online, including activists and journalists — Right.
- Only government agencies
- Only people who have already been compromised
Access Now describes the Helpline as working with individuals and organizations worldwide to help keep them safe online.
Do it with FireAI
Put this lesson into practice on your own Mac.
- Pick the right security mode for where you are, and use the kill switch — Match FireAI’s strictness to where you are, and know where the emergency stop is.
- Rules: app, website, domain, IP or a range, forever or until you restart — Write a rule as precise as one address or as broad as an entire domain.
- Turn on threat lists, and investigate a flagged connection — Go from a red flag to a real answer in one page, without leaving FireAI.
Sources
- CISA / US-CERT: Data Backup Options
- Apple Support: Back up your Mac with Time Machine
- Access Now: Digital Security Helpline
- Freedom of the Press Foundation: Digital Security
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.