The 3-2-1 rule, restated for 2025

If you've spent any time reading about backups you have heard the 3-2-1 rule: three copies, on two different media, with one off-site. It is the single most-cited piece of advice in the field. It is also forty years old, and the way most photographers implement it in 2025 is a kind of cargo-cult version of the original that doesn't actually deliver the protection the rule was designed to give.

I want to walk through where the rule came from, what each number was actually meant to defend against, and what a modern photographer's implementation should look like — because the 2025 version is almost unrecognizable from the original, even though the underlying logic is identical.

Where the rule came from

The 3-2-1 rule was articulated in its modern form by photographer Peter Krogh in his 2005 book The DAM Book. The underlying logic is older — it traces back to IBM tape-backup recommendations from the 1970s and 80s — but Krogh is the person who packaged it for the photo industry and gave it its name.

The original IBM version was about tape. Three copies of every file. Two on different types of tape (or one on tape and one on disk). One stored at a different physical site, often a salt mine or a hardened bunker, sometimes literally driven by a courier in a station wagon to a sister office across the city. This worked for IBM because the failure modes IBM cared about were specific and well-understood: a single tape medium would degrade or get demagnetized; a single building would suffer a fire or a flood.

Krogh's contribution was noticing that photographers had exactly the same problem with exactly the same failure modes, just at a smaller scale, and that the same rule applied unchanged. He was right then. He is still right now. But the implementation needs translation.

What each number actually means

The reason 3-2-1 has survived forty years of technology change is that each number is a defense against a specific failure mode, and those failure modes don't change as technology changes. The number changes; the failure mode doesn't. Let me walk through what each digit is actually defending against.

The 3 — three copies — defends against single-copy loss. This is the most obvious one. If you have one copy and it disappears, you have nothing. Two copies covers most single-copy failures. Three is the belt-and-suspenders version that covers the case where a single event takes out two copies. Three is also the right number because the math gets very different at four and beyond: the marginal benefit of a fourth copy is small, and the cost of maintaining four is high. Three is the sweet spot.

The 2 — two different media — defends against media-class failure. This is the one most photographers misunderstand. The point is not "two drives" — it's "two different ways of storing data." A drive at home and an identical drive at the studio is one medium in two locations. If there's a manufacturing defect in that drive model, or a firmware bug, or a vendor-wide recall, both copies go down together. The second medium is supposed to be structurally different from the first. Hard drive and tape. Hard drive and optical. Hard drive and cloud object storage. The point is that the failure modes of the two media are uncorrelated.

The 1 — one off-site — defends against location-class failure. A fire, a flood, a burglary, a power surge that takes everything plugged into a single circuit, a roof leak you didn't know about. Location-class failures take out everything within a building boundary. The off-site copy is the survival case for these. The critical word is "off-site," not "off-shelf." A drive in your basement is on-site. A drive at your parents' house thirty miles away is off-site. A copy in cloud storage in a different state is very off-site.

These three failure modes — single-copy, media-class, location-class — are still the things that take down photographer archives in 2025. The rule still works. The implementation has changed.

The 1985 implementation

Let's translate. In 1985, the IBM-recommended implementation would look like:

• Copy 1 (working): Live data on a mainframe disk array.
• Copy 2 (different medium): Nightly tape backup, stored in the same building.
• Copy 3 (off-site): Weekly tape rotation to an off-site facility, driven by a courier.

That is 3-2-1: three copies, on two media (disk + tape), with one off-site. It is also exactly the workflow nobody has now.

The 2005 implementation (Krogh)

When Krogh wrote The DAM Book, the practical translation was:

• Copy 1 (working): Internal hard drive on the editing computer.
• Copy 2 (different medium): External hard drive at the studio, or optical (DVD/Blu-ray) backup.
• Copy 3 (off-site): External hard drive at home, swapped weekly.

This was 3-2-1 for the early-digital photographer. The off-site copy was still a physical drive moved around by hand. Cloud storage existed but was prohibitively expensive at the volumes photographers needed.

This is the version many working photographers — especially those who came up in that era — are still running. It's not wrong. It's just outdated.

The 2025 implementation

Here's where I'd argue the implementation actually wants to be in 2025:

• Copy 1 (working): The SSD plugged into your editing machine. Fast, local, scratch.
• Copy 2 (different medium): A networked storage device at the studio — a small NAS, or a backup drive on a different physical interface than your primary edit drive.
• Copy 3 (off-site, different medium): Cloud object storage at a vendor whose entire business is we will keep this file forever. Backblaze. S3. Wasabi. Vault (which sits on Backblaze).

This is still 3-2-1. Three copies, two media classes (local spinning rust + cloud object storage), one off-site. The shape of the rule is unchanged. What's changed is what plays the role of each number.

The "off-site copy" has stopped meaning a drive at a different building. It now means a cloud provider whose own internal redundancy is more durable than your studio. This is a much better off-site copy than a drive at your parents' house, because the cloud provider's own architecture already gives you geographic redundancy, hardware monitoring, and continuous integrity verification — things your parents' house cannot deliver.

The "different medium" requirement is the one that gets fuzzy in 2025. Both your local drive and your cloud copy are, technically, magnetic disks somewhere. They're both spinning rust at the storage layer. The reason this still satisfies the rule is that the failure modes are uncorrelated, which was the original point. A firmware bug that takes out your local SSD doesn't take out the cloud. A roof leak doesn't take out the cloud. A backup-software bug doesn't take out the cloud. The two copies share a physical-medium category but their actual failure exposure is independent. This is good enough for the rule.

What this means for your real workflow

If you're a working photographer in 2025, the implementation you want is:

1. Live working drive. Edit from a local SSD. Fast iteration, fast scratch, fast everything. Treat as disposable.
2. A studio archive layer. Either a NAS for instant local recall, or just a second local drive that holds last-month-and-prior. Treat as the warm tier.
3. A cloud vault. Every project pushed to cloud object storage immediately after the wedding. Treat as the cold tier and the source of truth.

The 3-2-1 rule is satisfied. The recovery scenarios are clean. A drive fails: redownload from the vault. The studio burns down: redownload from the vault. You ditch your workflow and switch tools entirely: export from the vault. The vault is the source of truth, and everything else is a working copy of it.

What I'd argue against

Two implementations I see often and disagree with:

Three drives, all spinning rust, no cloud. This is the most common "I follow 3-2-1" version among photographers. Studio drive, home drive, parents-house drive. It's better than nothing. It's worse than one local drive + one cloud copy. The reason: the three drives all share the same failure-mode class (consumer hard drive in a residential environment). They're not actually three independent copies; they're three correlated copies. A storm that knocks out power to the city might fry all three over the next two years through compounding partial failures.

Cloud-only with no local copy. Some photographers, having converted to cloud storage, ditch local entirely. This is also wrong — for the opposite reason. Cloud-only means a vendor outage takes you offline. You want a local copy for the same reason airlines want printed checklists: when the system fails, you need a fallback that doesn't depend on the system.

The right answer is what 3-2-1 said in 1985 and 2005: three copies, on two genuinely independent media, with one geographically distant. The 2025 photograph workflow happens to make that easy and cheap. Take advantage of it.

The point I keep coming back to

The 3-2-1 rule is the most durable piece of advice in the entire backup industry because it isn't about any specific technology. It's about defense in depth against three specific failure modes that don't change as technology changes. The same logic that protected an IBM tape library in 1985 protects a wedding photographer's RAW archive in 2025.

The implementation has changed three times in forty years. The rule has not changed once.

If you're following the rule the way it was implemented in 2005, you're not getting the protection it was designed to give. Translate the implementation forward. Three copies. Two media. One off-site. In 2025, that means local SSD + studio archive + cloud vault. The rule is the same. The defense is real. The photographer who follows it sleeps better.