AI-narrated version of this post using a synthetic voice. Great for accessibility or listening while busy.
RAID is not a backup.
Every year we hear the same home lab horror story: someone loses their NAS to ransomware, a lightning strike, or a firmware bug during an update, and RAID redundancy did nothing to save them. This guide covers the actual 3-2-1 backup strategy every home lab needs, plus specific gear picks and configuration steps for 2026.
Disclosure: affiliate links below. We earn a small commission at no extra cost to you.
What 3-2-1 actually means
The 3-2-1 rule is the durable-backup strategy every professional sysadmin follows and every home lab operator should:
- 3 copies of your data (original + 2 backups)
- 2 different storage media types (e.g., NAS spinning disks + SSD or NAS + cloud object storage)
- 1 copy stored off-site (physically distant from your home)
The “why” for each layer:
- Multiple copies protect against a single drive failure
- Different media types protect against a media-class failure (e.g., a firmware bug affecting all your WD Red drives simultaneously)
- Off-site copy protects against fire, theft, natural disaster, and ransomware that traverses your local network
What RAID protects (and doesn’t)
RAID protects against ONE thing: a single drive failure with rebuild-time-to-replace under the mean-time-between-failure. That’s it. RAID does not protect against:
- Multiple simultaneous drive failures (rebuild stress often kills a second drive)
- Ransomware (encrypts all mounted drives including RAID members)
- Accidental deletion (deletes propagate across all RAID members instantly)
- Firmware bugs (identical drives with the same firmware often fail identically)
- Fire, flood, theft (physical destruction hits the whole array)
- NAS OS corruption (bad update can render the whole array unmountable)
The 3-2-1 rule exists because backup professionals learned all of these the hard way.
The minimum 3-2-1 setup for a home lab
- Copy 1: primary data on your NAS (SHR/RAID 5 or 6)
- Copy 2: local secondary backup on a separate USB drive or a second NAS
- Copy 3: cloud backup (Backblaze B2, Wasabi, or Storj)
Total ongoing cost: $5-15/month for cloud, one-time $150-300 for the local secondary drive.
Layer 1: Your primary NAS
The starting point. Your NAS is not your backup; it’s your primary storage. It runs RAID 5 (three drives of usable + one of parity) or SHR-1 on Synology. The RAID protects against single-drive failure while you replace the failed drive. Nothing more.
For the NAS itself, see our detailed guides:
Layer 2: Local secondary backup
The second copy on different media, physically separate from your main NAS. Three good approaches:
Approach A: External USB drive rotation (simplest)
Buy two 8TB external USB drives. Every Sunday night, plug in Drive A, run a backup job (Synology Hyper Backup, Time Machine target, or rsync). The next Sunday, unplug Drive A, plug in Drive B, run the backup. Repeat. At any given moment one drive is disconnected and safe from ransomware.
Cost: $300-400 for two drives. Set-and-forget after initial setup.
Approach B: Second NAS or Mini PC + drives
For heavier home labs, a dedicated backup NAS (smaller, older, cheaper) or a Mini PC running TrueNAS SCALE with 2 large drives works well. Set up SSH-based rsync or Syncthing between primary and backup NAS. Backup NAS lives on a separate VLAN from your workstation (so ransomware on the workstation can’t reach it).
Approach C: SSD-based backup for hot data
If your primary workflow includes video editing or large datasets that you want backed up more frequently than nightly, an external SSD with continuous replication (Syncthing, Resilio, or macOS Time Machine to an SSD target) covers the gap.
Migration tip: use an offline SSD cloner during drive upgrades
When you eventually upgrade NAS drives (or your workstation SSD), the fastest safe migration is offline SSD-to-SSD cloning. The ELUTENG M.2 NVMe SSD Cloner Dual-Bay handles this at 20Gbps without needing a computer — press a button, clone completes, both drives are byte-identical. $37.
For 2.5″ HDDs/SSDs: the ELUTENG Dual-Bay Hard Disk Clone Dock ($27) does the same for spinning drives.
For a single M.2 SSD backup target: ELUTENG Single M.2 NVMe Docking Station at $13.
Layer 3: Off-site cloud backup
The single most important layer. This is what protects you from fire, theft, and ransomware that reaches your local network.
Cloud provider comparison
| Provider | Storage cost | Egress | Best for |
|---|---|---|---|
| Backblaze B2 | $6/TB/mo | 3x storage free | Best overall home lab |
| Wasabi | $7/TB/mo | Free (with limits) | Frequent restores |
| Storj (decentralized) | $4/TB/mo | $7/TB egress | Cheapest storage |
| AWS S3 Deep Archive | $1/TB/mo | Very expensive | Truly long-term archive |
| iDrive Personal | $100/yr 10TB | Included | Fixed-price small households |
Our pick for most home labs: Backblaze B2. Combines low storage cost with generous free egress (up to 3x monthly storage), native Synology / QNAP / rsync support, and a durable track record. $6/TB/month = $30/mo for 5TB = enough for most household media libraries + documents + photos.
Backup software for each layer
For Synology NAS
- Hyper Backup (built-in, free) — primary backup engine. Supports B2, Wasabi, S3, local USB, and remote NAS destinations
- Snapshot Replication (built-in, free) — native btrfs snapshots at file level. Fast rollback for individual file recovery
For QNAP NAS
- Hybrid Backup Sync (HBS 3) (built-in, free) — QNAP’s equivalent to Hyper Backup. Same cloud provider support
For UGREEN NAS
- UGOS Backup module (built-in) — supports basic destinations. For more mature cloud support, use Duplicati or Restic in a Docker container
For general purpose (any Linux/Mac)
- Restic (free, open source) — the gold standard for encrypted, deduplicated, incremental backups. Steep learning curve but incredibly reliable
- Kopia (free, open source) — newer alternative to Restic with a nicer UI
- rclone (free) — syncs to any cloud provider. Simple but doesn’t handle deduplication or encryption on its own
Testing your backups (the step everyone skips)
A backup you haven’t restored is a backup that doesn’t exist. Schedule quarterly restore tests:
- Pick a random file from 3 months ago
- Restore it to a scratch folder
- Verify the content is identical to the current version (checksum comparison)
- Time how long the restore took
- Repeat for a folder-level restore
Common failures you’ll find with regular testing:
- Backup job silently failing for months (retention policy expired old backups before the failure was noticed)
- Cloud credential expired but the NAS never alerted
- Restore-only permissions were never granted to the cloud account (works during backup, fails during restore)
- Compression / encryption library update broke old backup format compatibility
Ransomware-specific hardening
Ransomware attacks against home lab NAS units doubled from 2023 to 2025. Specific hardening to add on top of 3-2-1:
- Immutable backup snapshots — enable object lock on your B2/Wasabi bucket. Ransomware can’t delete or overwrite backups that are locked
- Air-gapped local copy — the USB rotation approach automatically air-gaps half your backups at all times
- Separate backup credentials — the account used for backups should NOT be the same as your NAS admin. Reduces blast radius if primary account is compromised
- Backup-only network segment — if you have a managed switch, put backup NAS on a VLAN that primary workstation cannot reach
- Multi-factor auth on cloud console — B2 and Wasabi both support 2FA. Turn it on
Cost summary (typical household of 4)
| Layer | One-time | Ongoing |
|---|---|---|
| Primary NAS (4-bay + 4x 8TB) | $1,100-1,400 | $3/mo power |
| Local secondary (USB rotation) | $300-400 | — |
| Cloud (B2, 5TB) | — | $30/mo |
| Total 3-2-1 | $1,400-1,800 | $33/mo |
Related reading on HomeNode
- Best NAS for First-Time Home Lab Builders Under $500
- Best UPS Battery Backup for Summer Storm Power Outages 2026
- ELUTENG Home Lab & Workstation Buyer’s Guide 2026
- UGREEN NAS Complete Buyer’s Guide 2026
FAQ
Isn’t cloud backup slow for terabytes? Initial upload is slow (a full 5TB seed can take 2-4 weeks over typical residential upload speeds). After that, only changed files are uploaded — typically a few GB per day for typical households. Backblaze B2 also offers “seed drives” for $185 that let you ship a physical drive for initial upload.
Can I use consumer cloud storage (Dropbox, Google Drive) as backup? Not for 3-2-1 compliance. Consumer sync services sync deletions and overwrites — ransomware and human error propagate to the cloud copy. Use dedicated backup services (B2, Wasabi) with immutable / versioned storage.
How often should I run backups? Local backup: daily incremental, weekly full. Cloud backup: daily incremental is fine. The failure mode you’re protecting against dictates frequency — if you edit files heavily, hourly cloud sync makes sense.
Do I need to backup Docker containers and VMs? Yes, but selectively. Backup the compose files and persistent volumes (application data). You do NOT need to backup the container images themselves — those can be re-downloaded.
What about backing up the NAS OS itself? Synology, QNAP, and UGREEN all provide config export tools. Export monthly. Combined with your data backups, you can rebuild from scratch in 4-6 hours if the NAS OS dies completely.
Related Auburn AI Products
Building a homelab or self-hosting content site? Auburn AI has practical kits: