What a Backup Actually Is (and Why Yours Probably Isn't One)

Checked October 2026. If something here doesn't match what you see on your screen, tell me and I'll fix it.

Most people I talk to say they have a backup. When I ask where it is, the answers are usually "OneDrive," "that external drive in the drawer," or "I think my computer does it automatically." Sometimes those are backups. Usually they're not, and the person finds out on the one day it matters.

This is the long version of what a backup is, what it isn't, what breaks them, and how to make one that will actually give your files back. It's written for people who run a business or a household on one computer, not for IT departments. The short version is at the end, and every section links to a deeper guide if you want it.

What a backup is

A backup is a second copy of everything on your computer, kept somewhere the computer can't quietly ruin, that you have proven you can get back.

That's three parts, and most people have one of them.

A second copy of everything. Not just the Documents folder. Everything: Windows itself, your programs, your settings, your email, the files on the desktop, the photos in the folder you forgot about. The reason is simple. When a computer dies, you don't want a pile of files. You want the computer back, working, the way it was on Tuesday. A copy of everything is called a system image, and it's the difference between "I have my spreadsheets" and "I'm back at work."

Somewhere the computer can't ruin. A copy on the same drive as the original isn't a backup. It dies with the drive. A copy on a drive that's always plugged in isn't much better, because anything that happens to the computer, including ransomware, happens to that drive too. The copy has to be somewhere the computer can't reach on its own: a drive that gets unplugged, or a second copy that lives somewhere else.

Proven to come back. This is the part everybody skips. A backup that has never been restored is a guess. The job says "success" every week, and nobody finds out it stopped working eight months ago until the day they need it. The only way to know a backup works is to pull something out of it and check that it matches. Here's how to do that in five minutes.

If you've got all three, you have a backup. If you've got one or two, keep reading, because the gap is usually small.

Is OneDrive a backup? (Or Google Drive, or iCloud, or Dropbox)

No. This is the most common misunderstanding I run into, and it's not your fault, because Microsoft literally calls the button "Back up."

OneDrive, Google Drive, iCloud, and Dropbox are sync services. Sync means: whatever happens to the folder on your computer happens to the copy online, as fast as your internet allows. That's the whole point of sync, and it's great for getting to your files from your phone.

It's also exactly what you don't want from a backup. Delete a file by mistake and sync deletes it online. Save over the wrong version and sync saves over it online. Get hit with ransomware and sync uploads the encrypted versions, overwriting the good ones, in the time it takes you to notice something's wrong. A sync folder copies your mistakes at the same speed it copies your work.

Most of these services keep old versions for a while, and OneDrive has a "restore your files" feature that can roll a whole account back to a point in time. That helps, sometimes, and it's worth knowing about. But it won't bring back your programs, your settings, or Windows itself, and it only covers the folders you chose to sync. It's a safety net for files, not a backup of a computer.

Where the sync folder does fit: as the place your second copy lives. A real backup on an external drive, plus a copy of that backup in a folder your own cloud service syncs, gives you a copy off-site without paying for a second cloud bill. That's how VaultGuard Backup uses it, and it's the right job for a sync folder. More on what Windows' own tools do and don't cover.

Does Windows Backup actually work?

Partly, and the name is doing a lot of work.

The Windows Backup app in Windows 11 saves your settings, your list of Microsoft Store apps, and whatever folders you point at OneDrive. It does not make a copy of your whole computer, and it cannot restore Windows itself if the drive dies. Here's exactly what it saves and what it skips.

The newest Windows, version 26H2, also turns on something called point-in-time restore by default. It takes a snapshot of the Windows drive every day and keeps three days' worth. That's useful for undoing a bad update or a bad install. It's not a backup, because the snapshots live on the same drive as everything else. What 26H2's "backup by default" really covers.

There is a real whole-computer backup buried in Windows, the old "Backup and Restore (Windows 7)" tool, and it still works. It makes a system image. What it doesn't do is check that the image is any good, tell you when it fails, or help you when the restore goes sideways. If you're using it, here's how to restore from it, and what to do when Windows says it can't find your backup.

What ransomware does to a backup

People picture ransomware as something that locks their files. It does that. The part they don't picture is that the first thing modern ransomware does, before it locks anything, is go looking for the backup.

It deletes Windows' shadow copies, which are the snapshots System Restore and point-in-time restore depend on. It encrypts any external drive that's plugged in, because to the computer that's just another drive. If there's a network storage box in the office, it finds that too. This month a ransomware group called The Gentlemen was added to MITRE's catalog of attackers specifically for locking NAS devices along with the PCs. The backup that survives is the one the computer couldn't reach.

That's the whole reason for the "somewhere the computer can't ruin" rule. A backup drive that lives unplugged, or a second copy that's off the machine, is the thing that turns ransomware from the end of a business into a bad week. What ransomware is, in plain English. How to recover from it without paying. And whether it's hit anybody around here.

How do you know your backup works?

You restore something from it.

Not the whole computer. One file, or a handful. Pick a file you'd be upset to lose, pull it out of the backup to a different folder, open it, and check that it matches. If it does, you've learned more about your backup in five minutes than the "success" message has told you in a year. If it doesn't, you found out on a Tuesday afternoon instead of the day the drive died. The five-minute test, and the monthly routine that keeps it honest.

Every backup failure I've ever seen had the same shape. The job ran fine for months. The drive filled up, or the drive started failing, or a Windows update changed something, and the job kept reporting success while quietly backing up nothing useful. Nobody checks a green light. The restore is the only check that counts.

If you'd rather not remember to do it, this is the one job I think a computer should do for you. VaultGuard Backup pulls a sample of files out of the backup every week, compares them to the originals, and emails you if they don't match. Here's what that test looks like when it runs. You can also score your current setup in two minutes and see which of the three parts you're missing.

How to make a real backup this weekend

The rule everybody in this field uses is called 3-2-1, and it's older than you'd think. A photographer named Peter Krogh wrote it down almost twenty years ago in a book about managing photo files, back when a dead drive meant a lost career, and it's been the standard ever since. Three copies of your data, on two different kinds of storage, with one of them somewhere else.

The 2026 version adds two things Krogh didn't have to worry about: every copy has to be tested, because an untested copy may be zero copies, and at least one copy has to be out of reach, because ransomware will take any copy it can touch.

Here's what that looks like on one computer.

1. Get an external drive that's bigger than your computer's drive. Settings > System > Storage shows how much you're using. Double it and buy that. A plain USB drive is fine.

2. Make a system image, not a file copy. Windows' Backup and Restore (Windows 7) tool can do it, and so can VaultGuard Backup. Either way, the thing you want on that drive is the whole computer, bootable, not a folder of documents. If you're starting from zero, the starter guide walks through the first one.

3. Make a second copy somewhere else. A second external drive that lives in a different building, or a copy of the backup placed in a folder your own cloud service already syncs. One drive is one point of failure.

4. Unplug the main backup drive when it's not backing up, or set things up so the backup runs on a schedule and the drive is otherwise not in reach. Ransomware can't encrypt a drive that isn't connected.

5. Restore one file. Right now, before you trust it. Then put a reminder on your calendar to do it again next month.

6. Write down where the recovery pieces are. If the drive is encrypted with BitLocker, the recovery key has to live somewhere other than the computer. Windows encrypts drives without telling you, and here's why that matters for a backup. A backup you can't unlock is a very safe brick.

That's the whole job. It takes an afternoon the first time and almost nothing after that.

When it goes wrong: how to restore

The day you need the backup is the wrong day to learn how to use it. Two guides cover the two situations:

• The same computer, after something broke: how to restore a Windows backup, and what to do when Windows says it can't find the backup, asks for a BitLocker key, or quits partway through.

• A different computer, after the old one died: how to put a system image onto a replacement PC, and what to do when the new drive is "too small" or the restored machine won't start.

Read them once now, while nothing is wrong. They're much shorter than they look when you're calm.

Where VaultGuard Backup fits

Everything above is free to do by hand, and if you do it, you're ahead of most businesses in the county. The part that's hard to do by hand is doing it every week, forever, and noticing the week it stops working.

That's what I built VaultGuard Backup for. It makes the system image on a schedule, takes a fingerprint of it, keeps a second copy on another drive or in a folder your own cloud service syncs, and then every week restores a sample of files from both copies and checks them against the originals. If any step fails, it emails you that week and tells you which steps it's holding until you fix it. Your files stay on drives you own. What it does, step by step. The nine scheduled jobs and what each one checks. How to read the score it gives you.

If you're comparing it to something you already use, I wrote honest side-by-sides for Windows Backup, Acronis, Backblaze, and Carbonite. The Backblaze and Carbonite ones are worth reading even if you stay with them, because they explain what those services are good at and where the gaps are.

There's a free 14-day trial, no card. If you'd rather talk to a person first, that's what I'm here for.

The short version

A backup is a copy of your whole computer, kept somewhere the computer can't ruin, that you've restored at least one file from. A sync folder isn't one. Windows Backup isn't one. A drive that's always plugged in is a backup right up until ransomware finds it. Make a system image, keep a second copy somewhere else, unplug the main drive, and restore one file this weekend to prove it works. Then do that last part again every month, or get something that does it for you.

The day you need it is the wrong day to find out.

David Martin

Information Security Kentucky

Hardin County

Sources

• 3-2-1 rule origin: Peter Krogh, The DAM Book: Digital Asset Management for Photographers (O'Reilly, 2006; 2nd ed. 2009); Krogh received the Library of Congress NDIIPP Individual Innovation Award in 2012.

• The Gentlemen ransomware locking NAS devices: MITRE ATT&CK v20 release notes, October 13, 2026 (G1058, S9051).

• Windows 11 26H2 point-in-time restore defaults: Microsoft documentation, as covered in the 26H2 guide on this site.

• Ransomware deleting shadow copies: MITRE ATT&CK T1490, Inhibit System Recovery.