Back up and recover from information loss

مُحدَّث في14 March 2024

There is a common saying among digital protection professionals: "the question is not if you will lose your data, but when you will lose it." A backup plan can minimize what you lose, so you can still access important information if any of your devices are stolen, seized, or damaged. Take or consider the following steps to plan ahead.

Recover deleted or lost information

To reflect on what to do if you have lost your data, you can start troubleshooting with the help of the Digital First Aid Kit's guide I lost my data.

You can use the tools listed in this section to recover deleted or lost data that was stored in a computer or external device.

Be aware that these tools do not work if your device has written new data over your deleted information. If possible, stop using your device until you have tried to recover the files (or had someone do that for you). Doing additional work on your device could write over the files you lost and make them impossible to retrieve. The longer you use your computer before attempting to restore the file, the less likely it is that the file will be retrievable.

Linux, macOS, and Windows

• Try TestDisk & PhotoRec. See the official guide for instructions on how to use it.

Windows

• Try Recuva. See their guide.

Create a backup plan

To create a backup plan, take the following steps:

Organize your information

Before you make your backup plan, try to move all of the folders containing the files you intend to back up into a single location, such as inside the "Documents" or "My Documents" folder.

Identify where and what your information is

The first step to making a backup plan is to picture where your personal and work information is currently located. Your email, for example, may be stored on your email provider's server, on your own computer, or in both places at once. And, of course, you might have several email accounts.

Then there are important documents on the computers you use in the office or at home: word processing documents, presentations, PDFs and spreadsheets, among other examples. Your computer and mobile devices also store your contact lists, chat histories and personal program settings, all of which can be considered sensitive.

You may also have stored some information on removable media like USB memory sticks, portable hard drives and other storage media. If you have a website, it may contain a large collection of articles built up over years of work. Finally, don't forget your non-digital information, such as paper notebooks, diaries and letters.

You can learn more on how to map your information in the Holistic security manual section on understanding and cataloguing information.

Define which are primary copies and which are duplicates

When you are backing up files, it is sometimes suggested you use the 3-2-1 rule: have at least 3 copies of any piece of information, in at least 2 places, with at least 1 copy in a different place from the original.

Before you start making backups, decide which of the files you have mapped are "primary copies" and which are duplicates. The primary copy should be the most up-to-date version of a particular file or collection of files; it should be the copy you would actually edit if you needed to update the content. Obviously, this does not apply to files of which you have only one copy, but it is extremely important for certain types of information.

One common disaster scenario occurs when only duplicates of an important document are backed up and the primary copy itself gets lost or destroyed before those duplicates can be updated. For example, say you have been travelling for a week, updating a copy of an important spreadsheet stored on a USB memory stick. You should begin thinking of that copy as your primary copy, because it is more up-to-date than backup copies you may have made at the office.

Write down the physical location of all primary and duplicate copies of the information you have identified. This will help you clarify your needs and begin to define an appropriate backup policy. The following table is a very basic example. Your list may be much longer, and contain more than one data type stored on multiple storage devices.

In the table above, you can see that:

• The only documents that will survive if your office computer's hard drive crashes are duplicates on your USB memory stick and other external storage media as well as shared documents on the server.
• You have no offline copy of your email messages or your address book, so if you forget your email password (or if someone manages to change it maliciously), you will lose access to them.
• You have no copies of any data from your mobile phone.
• You have no duplicate copies, digital or physical, of printed documents such as contracts and invoices.

After following the checklist in this section, you should have rearranged your storage devices, data types and backups in a way that makes your information more resistant to disaster. For example:

In the new table you will have 3 copies of information: in the computer, in the office server and at home, in 2 places, and at least one copy outside the office. 3-2-1 rule :)

Once you have completed your checklist, it's time to make the backup copies.

Back up the files in your computer to a local device

Store your backup on portable storage media so that you can take it to a safer location. External hard drives or USB memory sticks are possible choices.

Because the files you decide to back up often contain the most sensitive information, it is important that you protect them using encryption. You can learn how to do this in our guide on how to protect information.

Linux

• Most Linux distributions include a backup tool. Ubuntu has a built-in tool called Déjà Dup which allows you to back up and encrypt your files. See this guide to Déjà Dup to learn how to use it.

macOS

• Back up to an external drive using Time Machine.

Windows

• Follow the instructions in the section on how to back up to an external drive in How to back up your files in Windows.

Back up your phone to a local device

If you are backing up your mobile device to your computer, your next step should be storing that backup to an external storage media device. Set your phone to back up automatically.

To back up the contacts, text messages, settings and other data on your mobile phone, you may be able to connect it to your computer with a USB cable. You may also need to install software from the website of the company that manufactured your phone.

Android

• Move files from your Android device to your PC.
• If you find it difficult to back up all different type of information from the Android phone to a computer you can back up to Google's cloud services using the tools built into your device. Be aware that in such case your information will be saved on servers owned by Google.

iOS

• Back up to your macOS computer
• Back up to your Windows computer
• Make sure to select the Encrypt local backup checkbox and to create a strong password.

Consider whether or not you should back up to "cloud" services

Consider whether you would prefer to use a service that encrypts your data for you as part of its service (called "end-to-end encryption" or "zero-knowledge" file storage services) or encrypt your files yourself and then back them up to the cloud.

Protect your files before you store them on cloud services

• Get Cryptomator and use it to protect files you want to store on the cloud service.
• Alternatively, use VeraCrypt to create an encrypted volume, then copy it to the cloud.

Encrypted cloud services

If you decide to keep your files in the cloud, consider using one of the following zero-knowledge, end-to-end encrypted options:

• Proton Drive (5 GB free; then paid)
• Mega.io (20 GB free; then paid)
• Sync (5 GB free; then paid)
• Internxt (10 GB free; then paid)
• Skiff Drive (10 GB free; then paid)
• Filen (10 GB free; then paid)
• PCloud (paid plans, specifically pCloud Encryption)
• SpiderOak (paid plans)
• Tresorit (paid plans)
• Nextcloud (NextCloud can be self-hosted if you have your own server, or else you can choose a hosting provider offering at least 2 GB free.)

Back up to cloud services using your device's built-in tools

Android

• Back up to your Google account.
• Backups are uploaded to Google servers and are encrypted with your Google Account password. For some data, your screen lock PIN, pattern, or password is also used to encrypt your data.

iOS

• Use iCloud.
• Encrypt your iOS backups.

macOS

• Use iCloud.
• Turn on Advanced Data Protection for iCloud.

Windows

• Use OneDrive.

Back up your email

• You can use an email client program (like Thunderbird) to regularly view and back up your email on your device. You can find explanations on the difference between downloading email with POP3 (to delete your email from the server) or IMAP (to keep it on the server) in the official Thunderbird documentation. Most email services provide instructions on how to set up an email client to receive your mail with POP3 or IMAP.

Scan and back up printed documents

• When possible, scan (or photograph) all of your important papers. Back up the scans or photos along with your other electronic documents, as discussed above.

Set a backup schedule

• To back up all of the data types listed above, you will need a combination of software and processes. Make sure that each data type is stored in at least two separate locations.

Practice recovery

• Once you have made your backups, test to make sure that you know how to open files and use them again. Remember that, in the end, it is the restore procedure, not the backup procedure, that you really care about!

Establish procedures for coworkers

• If you are working with a team, write up and share procedures for all staff to reliably and securely back up files. Communicate the risks that losing your data could have to your ability to do your work. It may help to work with your colleagues to fill out a grid like the one above to identify all data you work with as a team.

Other considerations

When you are making a backup plan, think of it in a larger perspective, asking yourself: "How can I recover from a disaster and keep working?"

Your plan should not just be about your files, but also about:

• Software you use, and the licenses for it,
• How you can replace equipment if it is lost, destroyed, or confiscated,
• Having a place you can go to to continue working in a crisis.

Planning for this may mean setting aside money to recover from a loss. For example, you might consider writing this amount into a grant.