Backing up a photo library: copies in more than one place and a test
Why a library that syncs is not a backup, how to reach two copies in different places and then three, why one copy should be unplugged, and the test that tells you a copy can be opened.
- Start here: the essentials
- Sync is not a backup
- How many copies, and what counts as one
- A copy from a computer
- A copy without a computer
- One copy unplugged, and older versions
- A copy away from home
- The test: open a photo from each copy
- 3-2-1, the NDSA levels and drive failures compared
- See it: Nadia, Ruth and Leo
- Practice: make the second copy and test it
- Your photos
- Check your work
- Knowledge check and scenario
Start here Essentials
For a first pass, this chapter asks you to reach two copies of your library in two different places and to prove that each one opens. A third copy, away from home, is the target; for now you only decide where it will live and when it goes there.
- Write down the copies you have now. One row per copy on the backup sheet; a library that syncs counts once (what counts as a copy).
- Make a second copy on a drive. From a phone, export the unmodified originals; from a computer, use its own backup (without a computer, from a computer).
- Decide where a copy away from home will live, and when it goes there. A relative's house, a workplace or a second cloud service (a copy away from home).
- Open one photo from each copy. Copy it back and look at it full size (the test).
- Write the dates on the backup sheet. The date each copy was made and the date you opened a photo from it, then unplug the drive (one copy unplugged).
Minimum time: about an hour of your own time, plus however long the export or first backup runs. Done when: the backup sheet shows two copies, each with a date and one photo opened from it.
Sync is not a backup Understand
Sync keeps the same library the same on every device signed in to one account: add a photo on the phone and it appears on the laptop; delete it on the laptop and it disappears from the phone. A backup is a separate copy that does not follow your changes straight away, so a mistake on one device does not reach it. Both are useful. Only the second protects you from a deletion.
The makers say so themselves. Apple says that when you use iCloud Photos and delete a photo on one device, it is deleted on every other device signed in to the same Apple Account (Apple's iCloud storage page). Its iCloud Photos page says items uploaded to iCloud Photos are not duplicated in your iCloud backup, and to keep backup copies of your library (Apple's iCloud Photos page). Google says that deleting a backed-up item in the Google Photos app deletes it on every device where backup is on (Google's Delete photos page). Product-specific
| Service | What a deletion does | Is it a backup of your phone? |
|---|---|---|
| iCloud Photos | Deleted on every device; kept in Recently Deleted for 30 days. Over your iCloud storage limit, Apple says deleted photos are removed at once and do not wait in Recently Deleted. | No. It is the library itself, kept in step across devices. |
| Google Photos (backup on) | Deleted in the app means deleted on the phone and in the cloud; the trash keeps items 30 days. | No. Google calls it backup, but deletions travel both ways. |
| OneDrive camera backup | Microsoft says it uploads one way: deleting a photo from the phone after upload leaves the OneDrive copy (Microsoft's camera backup page). | It is a copy, in one account. Deleting inside OneDrive still deletes there. |
So a library in iCloud Photos or Google Photos counts as one copy, however many devices show it. That is also why One home for your photos treats the app library as the master and this chapter adds the copies. Recently Deleted and the trash are a 30-day safety net for a slip of the finger, not a copy; how deleting works covers them.
How many copies, and what counts as one
This manual's target is three copies of the library: the library itself and two backups, one of them away from home. Convention The first milestone, which Start here reaches, is two copies in two different places.
The three-copy rule is called 3-2-1: three copies, on two different kinds of storage, with one copy somewhere else. It began in a book on managing photographs, Peter Krogh's The DAM Book, and a 2012 US-CERT paper still hosted by CISA repeats it and credits him (CISA's Data Backup Options). The National Archives gives it to families scanning their photos: three copies, two kinds of media, one off-site (NARA's Digitizing Family Papers and Photographs). The Library of Congress asks for at least two copies, "as physically far apart as practical", and says more copies are better (Library of Congress, Keeping Personal Digital Photographs). That is why two copies in different places is the milestone and three is the target: the first meets the Library of Congress's floor, the second meets the National Archives' rule.
What counts as a copy
A copy, in this chapter, is a complete set of your originals at full size that you could open if every other copy disappeared. Count with the table below.
| Where | Counts as a copy? | Why |
|---|---|---|
| The library on a computer, or iCloud Photos or Google Photos in Original quality | Yes, one | It is the library. Every device that syncs with it is the same copy. |
| An external drive holding exported originals, or a computer backup such as Time Machine | Yes | A separate copy that does not follow your deletions. |
| A drive kept at someone else's house or at work | Yes, and it is the one away from home | A fire or burglary at home does not reach it. |
| A second cloud service that holds your originals | Yes, away from home | A separate account and company. It lasts while the account is paid and used. |
| Google Photos in Storage saver | No, not a full copy | Google resizes photos over 16 MP and may convert them to JPEG (Google's backup quality page). |
| A OneDrive folder with online-only files | Not until downloaded | The files are placeholders until opened (see a copy from a computer). |
| Photos posted to social media or sent in a chat | No, by this manual's count | The services do not say they keep your original file; Getting photos out treats an export as a record of what you posted. |
Write each copy that passes on the backup sheet: what it is, what it holds, where it is, and whether it updates by itself or by hand. A household with the library in iCloud Photos and nothing else has one copy, even with three devices. The space calculator tells you how much room the copies need in a few years.
Why "two kinds of storage"? The comparison below covers the 2012 reasoning (discs going out of use), Backblaze's reading that two separate devices are enough today, and the NDSA levels, which climb from two copies to three in places with different disaster threats.
A copy from a computer
If the library lives on a computer, or the computer can hold a full copy of it, the computer's own backup is the simplest second copy.
- Mac. Apple's Photos guide for macOS 27 says to back up your photo library locally even if you use iCloud Photos, with Time Machine or by dragging the library (in the Pictures folder by default) to an external drive (Apple's Back up your photo library on Mac). If the library itself lives on an external drive, Apple says not to put a Time Machine backup on that same drive. Photos you added as referenced files, stored outside the library, are not backed up with it; Apple says to back them up separately. Product-specific
- Mac with iCloud Photos and Optimize Mac Storage on. The Mac then holds smaller versions, and a backup of the Mac holds those too. Apple's setting Download Originals to this Mac (Photos > Settings > iCloud) keeps full-size originals on the Mac (Apple's iCloud Photos page), if the Mac has room.
- Windows and Chromebook. The steps for File History, Windows Backup and Chromebook backups, with a restore test for each, are in Learn Digital Security's Backups chapter (device backups for phones and computers, and how to test one). That chapter notes that Windows Backup syncs folders to OneDrive and suggests using it beside File History.
OneDrive placeholders
On Windows, OneDrive's Files On-Demand is on by default in current versions. An online-only file shows a cloud icon, takes no space on the computer and does not open offline (Microsoft's Files On-Demand page). Such a file is a placeholder file: a name and an icon standing in for a file that lives in the cloud. Microsoft's page does not discuss backup programs, but a backup that copies a folder of placeholders may copy placeholders, not photos. To make the photos real files on the computer, right-click the folder and choose Microsoft's option Always keep on this device, if the disk has room. Then back up, and open a photo from the backup to be sure. Test it
A copy without a computer
A phone and a drive are enough. You need a drive that plugs into the phone (a USB-C drive for a recent iPhone or most Android phones, or an adapter) with more free space than the library uses.
iPhone
Apple's iPhone guide for iOS 27 gives these steps for exporting to an external drive (Apple's Import and export photos and videos on iPhone):
- Connect the drive to the iPhone.
- In Photos, select the photos and videos to export.
- Tap the Share button, then Export Unmodified Original.
- Tap the drive under Locations, then tap Save.
An unmodified original is the file as the camera saved it, before any edits. Apple's page says edited photos export as the unmodified original, so edits stay behind in the library. It also says photos in a locked Hidden album are not transferred; to include them, Apple says to turn off Use Face ID, Use Touch ID or Use Passcode in Settings > Apps > Photos. Product-specific Apple's page gives no limit on how many items one export can take. Our suggestion is to export a year at a time, into a folder named for the year, so a stalled export is easy to notice and finish. Preference Folders and file names has the folder pattern.
If Optimize iPhone Storage is on, the phone holds smaller versions and iCloud holds the originals. Apple's export page does not say how it handles that case, so check one exported photo's size or open it at full size before you rely on the export. One home for your photos explains the setting.
Android
For photos in Google Photos, Google Takeout makes an archive of your library. Google says Takeout can schedule exports every two months for a year, and that with Google Photos as the only product selected a scheduled export can cover new and updated data. The archive arrives as a download link or in Drive, Dropbox, OneDrive or Box; each archive expires in about seven days (Google's How to download your Google data). Delivered to another company's cloud, it is a copy away from home as well. Google's page does not describe the folder layout or say whether edited versions or originals arrive, so open some photos from the first archive and compare them with the library. For the phone's own camera folder copied straight to a drive, see Getting photos out. Product-specific
One copy unplugged, and older versions
An offline copy is a backup that is not connected to the computer or phone when you are not using it: a drive unplugged and put away. CISA's paper says to disconnect removable media when the backup is done. Its ransomware guide for organizations says to keep offline backups, because many kinds of ransomware (malicious software that locks your files and demands payment) look for connected backups to delete or encrypt them (CISA's #StopRansomware Guide). For a household, the habit is simple: plug in the drive, back up, unplug it. Convention
A copy that only mirrors the library has a weakness of its own. CISA's 2012 paper warns that rolling backups can silently carry corruption or malware from the original files into the backup. Stanford's library guide describes storage as usually a mirror, identical to the original, and a backup as a snapshot at a point in time (Stanford Libraries' Store and backup files). A version is one of those dated snapshots. Time Machine keeps several; a drive you export to by hand keeps whatever you last put on it, and a drive you do not overwrite keeps last season's photos even if this season's go wrong. When you update a drive by hand, add the new photos; do not delete from the drive what you deleted from the library until you have decided you meant it.
A copy away from home
Copies in one place share one disaster. Stanford's guide tells of a scholar whose three copies of eighteen years of notes were all in one office and were destroyed together by arson in 1970. Principle The copy away from home is the one that survives a house fire, a flood or a burglary that takes the laptop and the drive beside it.
| Where it can live | How it updates | What it costs you |
|---|---|---|
| A drive at a relative's or friend's home | By hand, when you visit: take the phone or the home drive and add the new photos | A second drive, and someone who agrees to keep it |
| A drive at work, in a desk or locker | By hand, when you bring it home and back | A second drive; check your workplace's rules |
| A second cloud service that keeps originals | Automatic, or a scheduled export | A paid plan once the library outgrows the free amount, and a first upload |
Pick one and write it on the backup sheet with a date: when the copy goes there, and how often it is brought up to date. Each season, or once a year when you visit, are both workable; the right one is the one you will keep. Preference A first upload of a large library can take many hours: the upload calculator gives the fastest it could go at your internet speed. A cloud copy lasts only while the account is used and paid; Formats and the long term covers the rules that delete unused or over-quota accounts.
The test: open a photo from each copy
A backup you have not opened is untested. The restore test is copying a photo back from a copy and opening it at full size. It proves that copy exists, holds photos rather than placeholders, and can be read by the phone or computer you have now. Test it
| Check | What it catches |
|---|---|
| Open one recent photo from each copy | A backup that stopped running months ago |
| Open one old photo from each copy | An export that missed early years |
| Open one video | Videos left out, or a format the device cannot play |
| Check that each copy's newest photo is recent | A copy that is out of date |
| Compare each copy's count with the library's | Large gaps (counts differ between apps; compare like with like, as Getting photos out explains) |
| Unplug the drive afterward | A drive left connected, within reach of a mistake or ransomware |
The test sheet on the backup page has these lines with a date and a result column. For a drive, plug it in, find a photo in the Files app or on the computer, copy it to the phone or desktop and open it. For a library in iCloud Photos or Google Photos, open a photo on another device or on the service's website. For Time Machine or File History, Learn Digital Security's Backups chapter restores one file step by step.
When to test: once a year, after you make a new copy, and before you delete anything you think is backed up. The yearly interval is this manual's convention. Convention CISA tells organizations to test backups regularly and gives no interval; no source we found gives one for households. The Library of Congress says to check your photos at least once a year to make sure you can read them, which is the nearest household figure. Put the date in your calendar and on the routine sheet.
Opening one photo proves that copy can be read; it does not prove that every file in it is intact. Checking many files, and checksums, are in Formats and the long term. This manual does not say how long a drive or a cloud service will last, and it does not recommend a product, a drive or a plan. Encryption, backup software settings and ransomware recovery beyond the unplugged copy belong to Learn Digital Security.
Drives do fail. In 2025, Backblaze's fleet of about 337,000 data-center hard drives failed at an annualized rate of 1.36 percent, about one or two drives in a hundred in a year (Backblaze Drive Stats for 2025). Those drives run all day in controlled racks, unlike a drive on a shelf, and the figure is a reason for a second copy, not a lifespan.
3-2-1, the NDSA levels and drive failures compared Go deeper
Where 3-2-1 came from, and its variants
CISA's 2012 paper credits the rule to the second edition of Krogh's The DAM Book (2009, page 207). Secondary sites date it to the first edition; we have not checked. The "2" in the 2012 paper means two media types, at a time when most computers still had a disc drive. Backblaze, which sells backup storage, now reads it as two different devices rather than two types of media, and mentions newer variants such as 3-2-1-1-0 and 4-3-2 (Backblaze's 3-2-1 page). The Canadian Conservation Institute, writing about discs, asks for three copies on at least two media types, one off-site, and different brands if one media type is used twice. For a family library, a computer plus two drives, or a phone library plus a drive and a second cloud, meets the spirit of all three readings.
The NDSA levels as a ladder
The National Digital Stewardship Alliance's Levels of Digital Preservation (version 2.1, March 2026) are written for institutions, but the storage row reads as a ladder a household can climb (NDSA's Levels of Digital Preservation).
| Level | Storage, in NDSA's terms | In a family library |
|---|---|---|
| 1 | Two complete copies in separate locations | The library and one drive, or the library and a cloud copy |
| 2 | Three complete copies, one in a separate geographic location | This manual's target |
| 3 | At least one copy facing a different disaster threat, and one on a different type of storage | A drive in another town, plus a cloud copy |
| 4 | At least three copies in separate places, each with a different disaster threat | Beyond what most households need |
NDSA's first level also asks for an inventory of what is stored where, backed up separately. The backup sheet, printed with the photo file, is that inventory.
Drive failure figures
Backblaze publishes failure rates for its own drives. For 2025 the annualized failure rate was 1.36 percent across about 337,000 drives, down from 1.55 percent in 2024. Its report for April to June 2026 gave a quarterly rate of 1.73 percent, which it called the highest in quite a while, and a lifetime rate of 1.41 percent (Backblaze Drive Stats for Q2 2026). An annualized failure rate is failures divided by drive-years of running time. Arithmetic, not a forecast: at 1.4 percent a year, a drive in that fleet has about a 7 percent chance of failing at some point over five years (1 minus 0.986 to the fifth power). A home drive is moved, dropped and left unplugged, so the figure does not transfer; it says only that failures are ordinary. Backblaze sells storage, so it has an interest in the subject; the data is published openly.
Ransomware and versions
CISA's ransomware guide also suggests more than one cloud vendor, in case every account with one vendor is affected. Stanford writes that usually only one version of a backup is kept, while naming Time Machine, which keeps many; check what your tool keeps.
See it: Nadia, Ruth and Leo See it
Nadia Brooks is a fictional person; every fact about her is invented for this manual. She has an iPhone (128 GB) that says storage is almost full, iCloud Photos on with a 50 GB iCloud+ plan holding 46 GB, Optimize iPhone Storage off, and about 7,800 photos and 260 videos since 2019. She has no computer. She buys a 1 TB USB-C drive.
Known: one copy (the library in iCloud Photos, which her phone syncs with); Optimize is off, so the phone holds the full-size originals; the drive has room for the 46 GB many times over. What she does: she writes the iCloud library as copy one on the backup sheet. She exports one year at a time with Export Unmodified Original into folders named 2019 to 2026 on the drive. She copies one photo from 2019 and one from this year back into Files, opens both full size, plays one video, writes the dates and unplugs the drive. That is copy two.
Assumed: that her sister Lila Brooks will keep a second drive at her home. Settled by: Lila, who agrees. Under that assumption, the away-from-home copy is a second drive at Lila's, updated each season when Nadia visits with her phone and exports the season's photos to it. Nadia writes "drive at Lila's, each season" on the sheet and does the first visit within the month. Open: whether she keeps it up (the routine sheet and her calendar, in Routines and handing on); whether her iCloud plan still fits next year (the space calculator).
Ruth Feldman (fictional) has a MacBook with Apple Photos, iCloud Photos off, about 31,000 photos, and an external drive she backs up to with Time Machine. Her son David Feldman lives in another state.
Known: two copies: the library on the MacBook and the Time Machine drive. Her test: she restores one old photo and one from last month from Time Machine and opens them. Both open. She writes the dates. Assumed: that David visits once a year. Settled by: David; he does. Under that assumption, a second drive lives at David's, and Ruth's copy goes onto it each year when he visits. Open: whether the Time Machine drive is left plugged in all the time; Ruth decides to unplug it between backups and plug it in each Sunday, a habit she writes on the routine sheet.
Leo Tran (fictional) has a Windows laptop with OneDrive, where Files On-Demand is on, and about 3,400 raw files from his camera on the laptop. He copied his Pictures folder to a drive and called it a backup.
Known: the copy finished quickly and the drive's folder looked full. The test: he opens a photo from the drive and it will not open; most of the files were OneDrive placeholders, so the drive held icons, not photos. What he does: he sets the photo folder to Always keep on this device, waits for it to download, backs up again and opens three photos, one raw, from the drive. Open: where his away-from-home copy lives; he writes "to decide by the end of the month" on the sheet.
Pages to read alongside, each free:
- Library of Congress, Keeping Personal Digital Photographs: the four steps, ending in at least two copies kept far apart and a yearly check.
- Apple, Import and export photos and videos on iPhone: the iOS 27 steps for exporting originals to a drive.
- Apple, Back up your photo library on Mac: Time Machine or a copy of the library, and the referenced-files warning.
- CISA, Data Backup Options: the 2012 paper with 3-2-1 and its origin in a photographer's book.
Practice: make the second copy and test it Practice
Minimum: make one copy of the library on a drive, open one photo from it, and write both dates on the backup sheet. Time: about an hour of your own time; the export or first backup may run longer. Materials: your phone or computer, an external drive with more free space than the library uses (a USB-C drive or an adapter for a phone), and the backup sheet.
- List the copies you have. One row each on the copies sheet. If the library is iCloud Photos or Google Photos alone, that is one row.
- Make the copy. Export Unmodified Original from an iPhone, a Takeout archive or the camera folder from Android, or Time Machine or the library copied to a drive from a Mac. On Windows with OneDrive, check for placeholders first.
- Open one old and one recent photo from the copy, and play one video. Copy each back and open it at full size.
- Write the dates. "Last updated" and "last photo opened from it" on the copy's row; the test lines on the test sheet.
- Unplug the drive and put it somewhere you will find it again.
- Write the away-from-home plan. A row for the third copy with "where" and a date, even if the drive is not bought yet.
Size the cloud option. Read the library's size off the phone or service, run the space calculator for three copies five years ahead and the upload calculator at your internet speed, and write both answers beside the away-from-home row with the date.
Your photos Your photos
Check your work Check your work
Criteria
- Does the backup sheet count a syncing library once, however many devices show it?
- Are there two copies in different places, each holding full-size originals?
- Has one photo been opened from each copy, with the date written?
- Is the drive unplugged between backups?
- Does the third copy have a place and a date, even if it does not exist yet?
- Is the yearly test in the calendar and on the routine sheet?
Worked example
Nadia's sheet has two rows: "iCloud Photos, all photos and videos, Apple, automatic" and "1 TB drive, exported originals 2019 to 2026, home, by hand", each with today's date in "last updated" and "last photo opened". A third row reads "second drive, Lila's, each season", with the date of her first visit. Her test sheet shows a 2019 photo, a recent photo and a video opened, and "unplugged". It passes. It does not say the drive will last, and it does not claim every one of the 8,060 items is intact; that is the yearly check in Formats and the long term.
Common mistakes
- Counting iCloud Photos or Google Photos as a backup. It is the library; deletions travel.
- Backing up OneDrive placeholders. The copy finishes quickly and opens nothing. Open a photo from it.
- Keeping every copy in one house. One fire takes all of them.
- Leaving the drive plugged in. A mistake or ransomware can reach it.
- Exporting edited photos and expecting the edits. Export Unmodified Original leaves edits behind; that is the point of an original.
- Deleting from the phone because "it's backed up". Open it from another copy first.
What is still unresolved
Whether every file in a copy is intact, and when to move to a new drive, are settled in Formats and the long term. Whether the routine holds is the yearly review in Routines and handing on, and who can find the copies after you is the note in the same chapter. Which drive or cloud plan to buy is yours to decide; this manual does not recommend one.