Backups

    Without a backup you're one click away from zero

    A dropped laptop, a fake invoice, a burglary or just one wrong click. With a good backup it's an annoying morning. Without one you lose your quotes, your invoices and your books. Or you pay criminals, with no guarantee of getting anything back.

    Play: survive the week
    Have us sort it out

    A story in pictograms

    Monday morning, 08:58

    Made up, but this is how it really goes. Below it, the same morning with a real backup.

    The day without a backup
    1. 08:58

      Monday. Coffee. The backup? You'll do it on Friday. Like last week.

    2. 09:03

      An e-mail from a 'customer': invoice 4471, in a zip file. You open it quickly.

    3. 09:04

      Your files get strange names. Then they won't open any more.

    4. 09:05

      On your screen: pay within 72 hours or lose everything.

    5. 09:07

      The USB disk with your backup? It was plugged into the laptop. Encrypted too.

    6. 09:30

      Quotes, invoices, photos, all your books. Who do you call now?

    Paying is no guarantee that you get your files back. A separate copy is.

    Same day, with a real backup
    1. 09:03

      Same e-mail, same click. Everyone clicks now and then.

    2. 09:04

      Same misery: everything on the laptop is encrypted.

    3. 09:10

      Network off. The backup disk was unplugged in the cupboard and the cloud copy keeps old versions.

    4. 14:00

      Laptop cleaned, copy restored, police report filed. By two o'clock you're back at work.

    3-2-1: three copies, two kinds of storage, one away from home. And test that restoring works.

    Game

    Survive the week

    Pick a backup and see which disasters your files survive. Seven days, seven classics.

    1. Choose your back-up

    1. Monday

      Coffee all over your laptop.

    2. Tuesday

      Accidentally deleted a folder of quotes, emptied the bin.

    3. Wednesday

      Ransomware from a fake invoice: everything on your laptop is encrypted.

    4. Thursday

      Someone takes over your cloud account and deletes everything.

    5. Friday

      Burglary. The laptop and the USB disk on your desk are gone.

    6. Saturday

      Fire in the office.

    7. Sunday

      Your laptop gives up. Time to restore the backup.

    All outcomes at a glance
    DayNo backupUSB disk that stays plugged inSyncing to the cloud3-2-1, separate and tested
    Monday: Coffee all over your laptop.LostSavedSavedSaved
    Tuesday: Accidentally deleted a folder of quotes, emptied the bin.LostSavedPartly lostSaved
    Wednesday: Ransomware from a fake invoice: everything on your laptop is encrypted.LostLostPartly lostSaved
    Thursday: Someone takes over your cloud account and deletes everything.SavedSavedLostSaved
    Friday: Burglary. The laptop and the USB disk on your desk are gone.LostLostSavedSaved
    Saturday: Fire in the office.LostLostSavedSaved
    Sunday: Your laptop gives up. Time to restore the backup.LostPartly lostSavedSaved

    The rule

    3-2-1, and test the restore

    • 3 copies of everything that matters: the original and two backups.
    • 2 kinds of storage, for example a NAS and the cloud. Not the same disk twice.
    • 1 copy away from home, and preferably one that isn't plugged in or can't be wiped.
    • Test the restore. A backup you have never restored is a gamble.

    Syncing with OneDrive, Google Drive or Dropbox is handy, but it isn't a backup: if you delete something or ransomware encrypts your files, that goes straight to the cloud as well. Old versions help, but only if you know how far back they go.

    How it feels

    Sunday night, 22:47

    A conversation you'd rather never have. Based on a real case; names and details changed.

    The backup in the separate folderBased on a real case. Names and details changed.
    1. Ingrid (bookkeeping office)

      Bas, are you still up? All my files suddenly have weird names. And there's a note on the screen.

    2. Bas (does the computers)

      What does it say?

    3. Ingrid (bookkeeping office)

      That everything is encrypted and I have to pay in bitcoin. I don't even know how that works.

    4. Bas (does the computers)

      Don't pay and don't delete anything. Pull the network cable out of the server. We've got a backup, right?

    5. Ingrid (bookkeeping office)

      Oh yes, every night! It's on the server itself, in a separate folder. Super handy.

    6. Bas (does the computers)

      On the same server?

    7. Ingrid (bookkeeping office)

      Yes? That way I never have to swap a disk.

    8. Bas (does the computers)

      Then that folder's encrypted too. Everything on that server is encrypted.

    9. Ingrid (bookkeeping office)

      Three clients are coming in at nine tomorrow for their tax returns. What do I do now?

    10. Bas (does the computers)

      I'll come round first thing and we'll report it to the police together. And after that: two disks, in rotation, and one always stays at your place.

    What really happened (with the source)

    It really happened

    Big names forget too

    Click for what happened, what it cost and the link to the full story.

    • 2017

      The backup was on the same server

      A small Dutch bookkeeping office

      Cost: Three bitcoin in ransom (2,890.83 euros), one week without any work and another with hardly any. The total claim was over 42,000 euros; the court split the blame.

      What happened

    • 2023

      158 years old, and gone after one attack

      A British family-run haulage firm with around 400 lorries

      Cost: Without financial records the bank wouldn't lend. The firm went into administration in September 2023 and around 700 people lost their jobs.

      What happened

    • 2020

      Two disks in rotation, and the criminals got nothing

      A small Dutch office that handles clients' post and paperwork

      Cost: No ransom. The business was at a standstill for one day while everything was put right.

      What happened

    • 2019

      A phishing e-mail in October, a university down at Christmas

      A Dutch university

      Cost: A ransom of 30 bitcoin, almost 200,000 euros at the time. Dozens of staff worked through the Christmas holidays.

      What happened

    • 1998

      90 per cent of an animated film deleted, and the backup didn't work

      A major animation studio, in the middle of making a feature film

      Cost: A week of work on an unreliable restore was wasted, and 10 to 12 people worked non-stop for a whole weekend to check everything.

      What happened

    • 2017

      A database wiped, and the backups turned out empty

      An online platform for software developers

      Cost: Down for about 18 hours. More than six hours of changes were lost, affecting roughly 5,000 projects, 5,000 comments and 700 new user accounts.

      What happened

    All true stories about backups

    Questions

    Questions about backups

    How often should I make a backup?

    As often as you can afford to lose work. If you work on quotes and invoices every day, then every day, preferably automatically.

    Is a USB disk enough?

    As a second copy it's fine, as long as you unplug it after the backup. A disk that is always plugged into your laptop gets encrypted by ransomware too.

    How do I know my backup works?

    By restoring something now and then, for example one folder a month. It takes ten minutes and you'll sleep better.

    What if I've already been hit?

    Read first aid after a hack and send us a message. We normally reply within one working day.

    Press play

    Backups that work, even when you don't think about them

    We set up 3-2-1 for you, encrypted and automatic, and we test together that restoring works. The rule in short is in the Evo-log: the 3-2-1 rule without the fuss.

    Book a chat
    See IT security

    Switch on what you are happy with. You can change this any time with the "Cookie settings" link at the bottom of every page.

    Make the site and the shop work: your basket, checkout, logging in, security and remembering your cookie choice. Always on.

    Which cookies and storage?
    • Cookie choice - Remembers what you chose in the cookie banner.
      tde_consent
    • WooCommerce - The shop: your basket, checkout and order.
      woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*, store_notice*, woocommerce_recently_viewed, wc_cart_hash_*, wc_fragments_*, wc-blocks_*, wc_cart_*, storeApiCartData, storeApiCartHash, storeApiNonce
    • WordPress - Logging in to your customer account or the admin.
      wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie, wp-settings-*
    • Mollie - Payment. When you pay you go to Mollie, which uses its own cookies on its own pages. Nothing on this site.
    • Contact form - Keeps spam out of the contact form.
      tde_puzzle

    Remember small choices in your own browser: light or dark mode, calm mode, your triangle hunt progress and your best game score. Nothing is sent to us.

    Which cookies and storage?
    • Your preferences - Small choices, stored only in your browser.
      tdevo_*

    Count visits with Matomo on our own server, so we know what is useful. No advertising, no selling, no profiles across sites.

    Which cookies and storage?
    • Order source (WooCommerce) - Which page or campaign led to an order. Only with your consent.
      sbjs_*

    Videos and maps from other services (for example YouTube). They can set their own cookies when they load.

    Which cookies and storage?
    • YouTube - Videos, loaded only after you click (privacy-enhanced mode).
      set by YouTube

    Real story - 2017

    The backup was on the same server

    A small Dutch bookkeeping office

    What happened
    On 12 February 2017 hackers got into the network and encrypted every file on the server, including the backup files. They got in through a remote-working connection that was open to the internet, combined with a weak password. The office paid the ransom and got its files back. A court case with the IT supplier followed.
    Why it worked
    The only backup lived on the same machine as the data, so the ransomware simply took it too. A second disk to take home now and then had been suggested back in 2010. And at the office's request, the passwords had been made simpler.
    What it cost
    Three bitcoin in ransom (2,890.83 euros), one week without any work and another with hardly any. The total claim was over 42,000 euros; the court split the blame.
    What would have stopped it
    A backup on the same machine isn't a backup. Use two disks in rotation, one of them always unplugged and off site. And never leave remote access open to the internet without two-step verification.

    The full story (opens the original source):

    Summary by 3D-eVo in our own words, checked against the sources on 3 October 2026. The source is in charge of its own story.

    Real story - 2023

    158 years old, and gone after one attack

    A British family-run haulage firm with around 400 lorries

    What happened
    In June 2023 a ransomware gang encrypted the files of the firm and two sister companies. They got in by guessing an employee's password, with software that makes thousands of attempts. The owners refused to pay. A new transport system was running within days, but the financial records didn't come back: the criminals had also destroyed the backup that was supposed to be stored safely elsewhere.
    Why it worked
    A guessable password on an account that could be reached from outside, and an 'off-site' backup the attackers could still get to. A month earlier the firm had taken out a cyber insurance policy worth 1 million pounds.
    What it cost
    Without financial records the bank wouldn't lend. The firm went into administration in September 2023 and around 700 people lost their jobs.
    What would have stopped it
    Insurance doesn't replace a backup criminals can't reach. Keep an offline copy of your books and invoicing, and put two-step verification on everything that can be reached from outside.

    The full story (opens the original source):

    Summary by 3D-eVo in our own words, checked against the sources on 3 October 2026. The source is in charge of its own story.

    Real story - 2020

    Two disks in rotation, and the criminals got nothing

    A small Dutch office that handles clients' post and paperwork

    What happened
    On a Monday in February 2020 the office manager couldn't open any documents: everything was encrypted and a note asked for bitcoins. They cut every connection straight away, called their IT partner and checked whether the backup had been hit. It hadn't. Besides the daily backup at the office, a copy went to an external disk kept outside the office every month, with two disks used in turn.
    Why it worked
    The attack itself worked: the files at the office were encrypted. But the monthly copy was out of the criminals' reach.
    What it cost
    No ransom. The business was at a standstill for one day while everything was put right.
    What would have stopped it
    A simple rotation turns a disaster into a lost day. As they put it at that office: 'It seems like such a hassle, but that's nothing compared to the hassle you have when you're attacked.'

    The full story (opens the original source):

    Summary by 3D-eVo in our own words, checked against the sources on 3 October 2026. The source is in charge of its own story.

    Real story - 2019

    A phishing e-mail in October, a university down at Christmas

    A Dutch university

    What happened
    In mid-October 2019 phishing e-mails were opened on two workstations. Several variants had been sent, and a report about one variant wasn't properly followed up. The attackers moved through the network for more than two months. On 23 December they encrypted 267 Windows servers, including e-mail servers, file servers and a number of backup servers.
    Why it worked
    About 20 per cent of users open phishing e-mails, the university wrote itself. An administrator account was also used for routine maintenance, a server was missing updates and the network was fairly open. The online backups could be encrypted too.
    What it cost
    A ransom of 30 bitcoin, almost 200,000 euros at the time. Dozens of staff worked through the Christmas holidays.
    What would have stopped it
    Report every phishing e-mail and make sure every report gets followed up: one missed variant was enough. Keep backups offline and admin accounts separate.

    The full story (opens the original source):

    Summary by 3D-eVo in our own words, checked against the sources on 3 October 2026. The source is in charge of its own story.

    Real story - 1998

    90 per cent of an animated film deleted, and the backup didn't work

    A major animation studio, in the middle of making a feature film

    What happened
    Someone ran a delete command at the top level of the film project, and 90 per cent of the film vanished. The tape backups turned out to have failed without anyone noticing: the files had grown too big and the error log sat on the same full disk. The rescue: a colleague who had been working from home after having a baby had a full copy on her home computer. It was wrapped in blankets, strapped in with seatbelts and driven to the studio.
    Why it worked
    The backups were never test-restored, and the failure raised no alarm at all. The copy that saved the film existed by accident.
    What it cost
    A week of work on an unreliable restore was wasted, and 10 to 12 people worked non-stop for a whole weekend to check everything.
    What would have stopped it
    A backup is only real once you've restored something from it. Make sure error alerts reach a person, and keep a copy somewhere else on purpose, not by luck.

    The full story (opens the original source):

    Summary by 3D-eVo in our own words, checked against the sources on 3 October 2026. The source is in charge of its own story.

    Real story - 2017

    A database wiped, and the backups turned out empty

    An online platform for software developers

    What happened
    Late in the evening an engineer tried to fix a problem with the standby database and wiped the database folder. Only it turned out to be the main database. The engineer stopped a second or two later, but by then about 300 GB was gone. Then the backup storage turned out to be empty: the backup job had been failing, and the failure e-mails never arrived. The rescue was a copy that happened to have been made for a test that afternoon.
    Why it worked
    Several backup methods, but none of them tested, and nobody owned them. The company wrote it down itself: there was no ownership, so nobody was responsible for testing.
    What it cost
    Down for about 18 hours. More than six hours of changes were lost, affecting roughly 5,000 projects, 5,000 comments and 700 new user accounts.
    What would have stopped it
    Give your backups one named owner, test restores on a fixed schedule and make sure a failed backup can't fail silently.

    The full story (opens the original source):

    Summary by 3D-eVo in our own words, checked against the sources on 3 October 2026. The source is in charge of its own story.