I can't start over, so I back up every night
2026-11-04
I could never imagine starting over, so my machine has a backup chain that goes past the 3-2-1 rule for my work. Every night a full clone of the system disk runs first, and an encrypted Grandfather, Father, Son image goes to a mirrored NAS with 16 TB of drives after it. My work also sits off site in Proton Drive.
What would starting over cost me?
The work that no repo holds, and the machine set up around it. My site and my tools have git history, so that part survives a lost disk. My work folder has none. On 1 October it held 30 918 files and 873 MB of measurements and working files that exist nowhere in git.
The machine takes longer to replace than its disk. A clean install means setting up and measuring the firewall rules, the app profiles, the policy file and my own gates again. Two private keys cannot be regenerated at all.
How fast does the workspace change?
The workspace changes every day. On 4 November it held 107 631 files and 3 785 MB without node_modules and the git folders, and the work folder had grown to 104 336 files and 3 674 MB. My logs hold 750 numbered decisions. On 3 and 4 November the incremental images were 35,14 GB and 18,29 GB of changes across the system disk. The clone and the image run every night because a copy from last week would lack those changes.
How does my setup map to the 3-2-1 rule?
The rule asks for three copies, on two kinds of media, with one of them off site. My work meets all of it. The whole machine meets the first two parts, because no full image of it leaves the building.
| Where | What it holds | What it is for |
|---|---|---|
| 1 TB NVMe disk inside the machine | A full clone of the system disk, renewed every night | Meant to be the fastest way back after the system disk fails |
| Synology NAS, two 8 TB drives mirrored | Encrypted Macrium images on a Grandfather, Father, Son schedule, every night | Going back to an earlier day |
| Snapshots on the NAS | Immutable snapshots of the image folder, the latest 14 | An image deleted by mistake |
| Proton Drive | An encrypted cloud copy of my workspace | The off-site copy of my work |
| 1 TB encrypted disk kept off site | My important files, without a machine image | A second off-site copy |
| Private GitHub repo | The version history of my knowledge base | A record of every committed change to it |
The clone runs first, the image an hour later and the snapshot an hour after that, so that each snapshot can hold that day's image.
Why run both a clone and an image?
They fail in different ways. The clone is meant to get me working again fastest, and it holds one moment. The image holds history, and a machine normally needs a restore before it can run from it.
A clone copies whatever is on the disk that night, damage included. One of my agent sessions once truncated a shared log. A file damaged like that before the clone runs replaces the last good version on the clone. That log came back from git, and one session's entry was lost. For a file outside git, the images hold the older versions.
A full image runs on the first Monday of the month, a differential every Monday and an incremental every day. I keep full images for 14 weeks, differentials for 4 weeks and incrementals for 7 days. Macrium encrypts each image with AES-256 and verifies every backup after the run, and it notifies me if one fails. The full image of 2 November was 91,27 GB, and the run with its verification took 17 minutes 36 seconds.
Is a mirrored NAS already a backup?
No. A mirror survives one drive failing, and a deleted file leaves both drives at once. When I set it up on 15 October my NAS had one 8 TB drive, and a drive failure then would have taken the images and the snapshots together. The second drive turned 16 TB of disks into 8 TB of mirrored space, and a full image of 91,27 GB leaves the schedule plenty of room. Snapshots guard against deletion, and they are lost along with the NAS.
What has gone wrong so far?
Five incidents from my records since August, and none of them forced me to start over.
- 24 August. The Proton Drive client died silently for about 39 hours, and nothing in my workspace showed it. A morning check now tests that the client runs and has written a fresh log.
- 17 September. A second cloud sync service I ran then started with an empty sync state and rolled 1 380 files back to their July versions. I recovered them from the renamed files that the client left on my local disk, so no backup layer was used. I removed that service a week later.
- 30 September. I reinstalled Windows and restored my workspace from a Proton file copy made before my first sign-in to the new Windows. Proton had not downloaded its online-only files, so the work folder came back as empty folders, and I refilled it from Proton. Whatever I wrote that day before the reinstall is lost. My secrets vault would not decrypt under the new Windows profile, and the private keys came back from encrypted copies kept elsewhere. I did not read the nightly disk, and no image was on a schedule yet.
- 15 October. I deleted my first two images on the NAS by accident. No snapshot existed yet and the share had no recycle bin, so both are gone for good. I set up snapshots the same day.
- 18 and 19 October. The image failed on both nights because the power cord of the NAS was not pressed fully into its UPS, so the NAS path was not found. The clone ran normally. I did not follow it up until 27 October, when an agent session read the header of every log. A morning check now also goes red when the newest successful clone or image is older than 30 hours.
From 16 October to 4 November the Macrium logs show a clone on each of the 20 days with no error, and an image on each of the 20 days with those two failures.
How do I know a restore works?
I know part of it. I last tested a boot-from-image restore through Macrium's boot manager on 8 July, on the chain before the NAS, and it worked. In October I decrypted an encrypted image, hashed its whole content and compared it with the C: drive, and the hashes matched.
I have not restored a full disk from a NAS image. In my post on the clean install I wrote that I would test a restore once the first image was on the NAS. The hash comparison is what I have done so far, and a full disk restore is still open.
What does this not show?
This is one person's machine, and the run counts cover 20 days. My records show no boot from the clone and no restore from a snapshot. A fire at home would take the machine, the clone and the NAS together, and I would then rebuild Windows and restore my files from the off-site copies. I built the chain for hardware failures and my own mistakes, and I make no claim about a deliberate attacker.
Frequently asked
What is the difference between a clone and a disk image?
A clone is a second disk that is meant to boot as it stands, and each run replaces the last one, so it holds one moment. An image is a set of files that can hold many points in time, and a machine normally needs a restore before it can run from it.
Is a mirrored NAS a backup?
A mirror alone is not. It keeps working when one drive fails, and a deleted file leaves both drives at once. Mine holds backups, and snapshots on it protect those backups against deletion.
What does a Grandfather, Father, Son schedule keep?
It keeps older generations at longer intervals. Mine makes a full image on the first Monday of each month, a differential every Monday and an incremental every day. Full images stay 14 weeks, differentials 4 weeks and incrementals 7 days.
Does the 3-2-1 rule need a full machine image off site?
The rule counts copies of your data, so off-site copies of my files meet it for my work. My machine image has no off-site copy, so a fire would mean rebuilding Windows and restoring the files.
Updated 2026-11-04. The post now says that Macrium notifies me when a backup fails, and it names the cause of the failed images of 18 and 19 October.