Est. 2026

Independent, practical writing on work, money, home and life.

How to Back Up Your Photos Properly

A simple, durable system for protecting family and work photos from lost phones, failed drives and ransomware, built on the 3-2-1 rule CISA recommends.

A smartphone beside a keyboard on a wooden desk

This guide is for someone whose most precious files are photographs, scattered across a phone, an old laptop and perhaps a forgotten cloud account: a parent with ten years of family pictures, a hobby photographer with a growing archive, a small business owner whose product shots live on one device. Ask yourself one question. If your phone fell in a lake this afternoon, which photos would you lose for good? If the honest answer is “some” or “I don’t know”, this is for you.

Why photos get lost

Photos disappear in a handful of predictable ways, and each one calls for a slightly different defence.

  • Lost, stolen or broken phones. The most common cause. A phone that only syncs to itself has no backup at all.
  • Failed drives. Hard drives and memory cards fail without warning, especially older ones or those carried around in bags.
  • Accidental deletion. A cleanup session that removes the wrong album, or a sync service that faithfully deletes a photo everywhere once you delete it in one place.
  • Ransomware and account compromise. Malware that encrypts files, or an attacker who gets into a cloud account and wipes it.
  • Forgotten accounts and dead services. An old email address, a closed photo site, a cloud plan that lapsed when a card expired.

A good backup system covers all five, not just the first.

The rule to follow: 3-2-1

The US Cybersecurity and Infrastructure Security Agency recommends the 3-2-1 backup rule in its guidance for small and medium businesses, and it works just as well for a family photo library:

  • 3 copies of important files
  • 2 different types of storage, such as a hard drive and the cloud
  • 1 copy stored off-site

The same CISA page also recommends protections for backups themselves, including physical security, encryption and offline copies. That last point matters for ransomware: a drive that is unplugged most of the time cannot be encrypted by malware on your computer.

Sync is not backup. If deleting a photo in one place deletes it everywhere, you have one copy, not two.

Sync is not backup

This is the misunderstanding behind most lost-photo stories. Services such as iCloud Photos, Google Photos and OneDrive are excellent at keeping your library the same across devices. But syncing means a deletion on one device usually becomes a deletion everywhere, after a recovery window that is often around 30 days. If you notice the problem after the window closes, the photos are gone from every synced device at once.

Use a sync service as one of your three copies. Do not treat it as all of them.

Building the system

Here is a setup that fits most households. It costs the price of one external drive plus a modest cloud subscription.

CopyWhereTypeUpdated
1. Working libraryPhone and main computerDevice storageConstantly
2. Cloud copyPhoto or backup serviceOnline, off-siteAutomatically
3. Local backupExternal hard drive or SSDPhysical, mostly offlineMonthly

Copy 1: the working library

Choose one computer, or one cloud library, as the “home” of your photos. Everything flows there. If photos live on three phones and two laptops, pick the one place they will all end up and move them.

Copy 2: the cloud

Turn on automatic upload from your phone to your chosen photo service. Check the settings carefully:

  • Upload at original quality if you care about printing or editing later
  • Make sure uploads happen on Wi-Fi so they actually run
  • Confirm that the plan has enough storage for your whole library, with room to grow
  • Protect the account with a strong unique password and two-factor authentication

Copy 3: the external drive

Buy an external drive at least twice the size of your library. Once a month, connect it and copy the month’s photos across, or run backup software that does it automatically when the drive is plugged in. Then unplug it and put it away. Keeping it disconnected most of the time is what gives you an offline copy.

Organising so the backup is useful

A backup of chaos is still chaos. A light structure makes it far easier to check that nothing is missing.

Use year and month folders

A folder per year with subfolders per month, such as 2026 › 2026-10, works with almost any software and survives moving between services.

Name the special folders

For events you will want to find, add a short description: 2026-10 Asha birthday. Keep the date first so folders still sort in order.

Delete the obvious duplicates, carefully

Bursts of near-identical shots and screenshots of parking tickets take up space. Thin them out occasionally, but do it in the working library and only after a backup has run.

Rescuing the old stuff

Most families have photos stranded on old devices and accounts. Gather them once and the job is done.

Old phones and laptops

Charge them, connect them, and copy the photos into your working library before they stop turning on.

Memory cards and old drives

Copy everything off first and sort later. Cards and drives degrade with age.

Forgotten cloud accounts

Many services offer an export tool. Google offers Takeout, for example, and most other photo services have a download option in account settings. Download the archive, check it opens, and add it to your library.

Prints and negatives

A flatbed scanner, a scanning service or even a good phone scanning app can digitise the irreplaceable ones. Start with the photos of people who are no longer around.

Choosing the hardware and services

You do not need expensive equipment, but a few choices make the system sturdier.

Hard drive or SSD?

A traditional spinning hard drive offers the most storage for the money and is fine for a drive that sits in a drawer. A solid-state drive is faster, lighter and better at surviving knocks, which makes it the better choice if the drive travels. Either works for the monthly copy.

One drive or two?

If your photos are especially valuable, for example a professional archive, buy two external drives and alternate them, keeping one at a relative’s house or at work. That gives you a second off-site copy that does not depend on any online account.

What about a home server?

Network-attached storage (NAS) boxes can back up every device in the house automatically. They are excellent for larger families or small studios but need some setup and care. A NAS that is always connected to the network is also exposed to ransomware, so it should not replace an offline copy.

Picking a cloud service

Consider four things: storage price at the size you need, whether uploads keep original quality, how easy it is to export everything if you leave, and how the service handles deleted items. A service that makes exporting hard is a risk to your archive in itself.

Sharing the plan

A backup only one person understands may be useless to the family if that person is unavailable. Write a short note listing where each copy lives, which accounts hold photos and where recovery information is stored, and keep it with your important household papers. Many password managers also offer emergency access features for a trusted contact.

Test your backups

A backup you have never restored from is a hope. Twice a year, choose ten random photos from different years and open them from the cloud copy and from the external drive. If any are missing or will not open, find out why while the originals still exist.

Photo backup checklist

  • One home for the working library chosen
  • Automatic cloud upload on, at original quality
  • Cloud account protected with two-factor authentication
  • Cloud storage plan big enough for the whole library
  • External drive bought, at least twice the library size
  • Monthly reminder to copy to the drive, then unplug it
  • Year and month folder structure in place
  • Old phones, cards and accounts rescued
  • Twice-yearly restore test in the calendar
  • Someone else in the family knows where the copies are

Takeaway

Three copies, two types of storage, one off-site: that is the 3-2-1 rule CISA recommends, and it covers almost every way photos get lost. Use a cloud service for convenience, an unplugged external drive for safety, and test both twice a year. An afternoon of setup now saves a decade of pictures later.

Editorial Team Avatar

About the author

The Sunday Letter

One useful read, every Sunday.

A short note from the editors with the week’s most practical article. No hype, no daily blasts.

Sign-ups are handled through our contact page for now.