Why a backup drive that stays plugged in isn't a backup

Most people I know do have a backup. It's an external drive, it's plugged into the PC, and some software copies files to it every night. On paper, they're covered.

Then ransomware runs once, and they find out what that setup actually was: a second copy of everything, sitting on a drive the malware could reach just as easily as the originals. It encrypts the documents, then it encrypts the backup drive, then it asks for money. I've watched this exact sequence get described in incident write-ups for years, and the "backup" is always in the casualty list.

Here's the thing nobody tells you when you buy a backup drive: the value of a backup is not that it exists. It's that it survives the bad day. And on the bad day, anything your computer can write to, the ransomware can write to. A plugged-in drive is just more storage for the fire to spread through.

What actually protects a backup

Three properties, in rough order of how much they matter:

1. It can't be reached from the machine it protects. Physically disconnected is the strongest form. A drive in a drawer has no API to exploit, no credentials to steal, no mounted filesystem to encrypt. This is the old air gap, and it still works precisely because it's dumb.
2. It can't be overwritten silently. Immutability, versioning, append-only — the software versions of not trusting the writer.
3. There is more than one of it, in more than one place. The classic 3-2-1 shape.

Most home and small-office setups have a weak version of #3 and nothing of #1 or #2. The drive hums along, permanently mounted, permanently writable. That's not a backup strategy. That's a mirror — and a mirror copies the disaster too.

Why nobody does the simple thing

The simple thing is: back up, then unplug the drive. People don't do it because people are people. Week one, you unplug it religiously. Week six, you forget twice. Month three, the drive lives plugged in, because the one time you needed it you had to crawl under the desk.

I run servers for a living, and I don't trust my own discipline either. Anything that depends on a human remembering, every single day, forever, is a process designed to fail politely.

So the disconnect has to be part of the backup itself — automatic, every run, no willpower involved. That's the whole idea behind the tool I ended up building for my own machines: the backup finishes, the drive ejects itself, and from that moment the copy simply isn't in the building as far as the network is concerned. If the PC gets hit an hour later, the backup is a dumb plastic box with a platter in it, and ransomware has nothing to say to it.

The uncomfortable test

If you want to know whether you have a backup or a mirror, ask one question: if this machine were fully compromised tonight — every credential, every mounted drive — what would still be intact tomorrow morning?

If the answer is "nothing," you don't have a backup problem you can solve with more storage. You have a reachability problem. Unplug something.

— Mario

I write about backups, self-hosting and keeping systems alive. I also build RansomShield (getransomshield.com), the air-gapped backup tool described above.