Why a backup drive that stays plugged in isn't a backup

Mario Fang — Tue, 10 Nov 2026 06:02:48 +0000

Most people I know do have a backup. It's an external drive, it's plugged into the PC, and some software copies files to it every night. On paper, they're covered.

Then ransomware runs once, and they find out what that setup actually was: a second copy of everything, sitting on a drive the malware could reach just as easily as the originals. It encrypts the documents, then it encrypts the backup drive, then it asks for money. I've watched this exact sequence get described in incident write-ups for years, and the "backup" is always in the casualty list.

Here's the thing nobody tells you when you buy a backup drive: the value of a backup is not that it exists. It's that it survives the bad day. And on the bad day, anything your computer can write to, the ransomware can write to. A plugged-in drive is just more storage for the fire to spread through.

What actually protects a backup

Three properties, in rough order of how much they matter:

It can't be reached from the machine it protects. Physically disconnected is the strongest form. A drive in a drawer has no API to exploit, no credentials to steal, no mounted filesystem to encrypt. This is the old air gap, and it still works precisely because it's dumb.
It can't be overwritten silently. Immutability, versioning, append-only — the software versions of not trusting the writer.
There is more than one of it, in more than one place. The classic 3-2-1 shape.

Most home and small-office setups have a weak version of #3 and nothing of #1 or #2. The drive hums along, permanently mounted, permanently writable. That's not a backup strategy. That's a mirror — and a mirror copies the disaster too.

Why nobody does the simple thing

The simple thing is: back up, then unplug the drive. People don't do it because people are people. Week one, you unplug it religiously. Week six, you forget twice. Month three, the drive lives plugged in, because the one time you needed it you had to crawl under the desk.

I run servers for a living, and I don't trust my own discipline either. Anything that depends on a human remembering, every single day, forever, is a process designed to fail politely.

So the disconnect has to be part of the backup itself — automatic, every run, no willpower involved. That's the whole idea behind the tool I ended up building for my own machines: the backup finishes, the drive ejects itself, and from that moment the copy simply isn't in the building as far as the network is concerned. If the PC gets hit an hour later, the backup is a dumb plastic box with a platter in it, and ransomware has nothing to say to it.

The uncomfortable test

If you want to know whether you have a backup or a mirror, ask one question: if this machine were fully compromised tonight — every credential, every mounted drive — what would still be intact tomorrow morning?

If the answer is "nothing," you don't have a backup problem you can solve with more storage. You have a reachability problem. Unplug something.

— Mario

I write about backups, self-hosting and keeping systems alive. I also build RansomShield (getransomshield.com), the air-gapped backup tool described above.

I run servers for a living. I still couldn't buy the backup I wanted, so I built it.

Mario Fang — Tue, 10 Nov 2026 02:29:55 +0000

I look after servers for a company. OA systems, databases, NAS boxes, the lot. Backups at work are boring in the good way: proper software, proper rotation, somebody's job to check the logs. Mine.

The problem was my own machines, and the small offices I help out now and then. For those, I wanted something very specific:

Back up every night, on a schedule, no human involved
To a plain USB drive, because that's what small offices actually have
And when the backup finishes, the drive disconnects itself

That last part is the whole point. Ransomware can't encrypt a drive that isn't there. Every backup tool I tried keeps the target mounted 24/7, which means the night your machine gets hit is the night your backups get hit too. They finish each other's sentences.

I looked around properly before writing any code. Veeam Agent is genuinely good and free, but the drive stays attached. Acronis wants to sell me a cloud suite. The NAS route works, but it means buying another box and becoming the person who maintains it. All I wanted was a backup that hangs up the phone when it's done talking.

So I built it. It's called RansomShield, and the idea fits in one sentence: backup runs, report goes out, drive letter disappears.

How it works on my own PC: a scheduled run copies the folders I picked to the USB drive, checks the result, sends me a report (email, or Feishu in my case), then removes the drive. If it spots files changing in ways that look like ransomware mid-run, it aborts and leaves the drive unmounted, so a bad night doesn't take the last good backup with it.

It's been running on my machine for months. I don't think about it most days, which is exactly what I wanted from it.

Some honest notes, because I'd rather say them here than have you find them:

Windows only. That's the world I work in.
It's not pretty. The installer has a wizard, the backup itself just runs and reports.
The installer isn't code-signed yet, so Windows SmartScreen will warn you on first install. The site shows the SHA-256 and how to get past the warning. A certificate is on my list; it isn't free, and neither am I yet.
It costs $9 a month or $79 a year per PC, because free turned out not to be a business model I can maintain in my spare hours.