A backup you cannot reach is not a backup
What you will learn
- The difference between having copies of your files and being able to open them
- How to find the chain that ends inside the building you just lost
- Why deciding what you will not protect is what makes the plan survive
My backups were good. Several copies, one of them in another building, and I tested restoring from them on a schedule. I was pleased with them right up until I asked a question I had been avoiding: if the house were gone, what exactly would I do on the first morning?
The answer was embarrassing. I would need a username and password to reach the copy stored elsewhere. Those were in a password manager. That password manager was unlocked by a key on a device in the house. The backup itself was fine. The way in was in the fire.
This is the failure that backup advice almost never covers, because the advice is about copies and this is about access. Three copies of a locked box is three locked boxes. The number everybody quotes is about surviving the loss of your files. It says nothing about surviving the loss of your ability to open them.
A spare key is only a spare if it is not inside the house. Taped to the inside of the front door, it is a spare key for somebody who is already in.
What I built instead
A small physical kit. A scrambled drive, carried by hand to a different building, with the passphrase written on paper and stored somewhere else again. Two objects, two places, and neither one is any use alone. The drive is unreadable without the paper. The paper is a meaningless string of words without the drive.
The surprise was how much of the work was deciding what to leave out
My instinct was to copy everything, because everything feels important when you imagine losing it. But a kit that takes three hours to put together and a large drive to hold is a kit you assemble once and then never refresh. A stale kit is a worse lie than no kit at all, because you believe in it.
So I cut. The film library did not go in: it is replaceable and enormous. Operating systems did not go in: they are downloads. What went in was the short list of things that are either irreplaceable, or that would cost me weeks to rebuild. The keys. The settings that record decisions I have long forgotten making. The documents nobody else has a copy of.
Deciding on purpose what you will lose is not defeat. It is the thing that makes the rest of the plan small enough to actually keep up. I will be wrong about something on that list, and I will find out at the worst possible moment.
Three copies of a locked box is three locked boxes.
How to build a scrambled recovery kit, what belongs in it, and how to keep the secret separate from the thing it opens. The value here is in the order and the honesty, not in any particular tool.
1. Write the first morning as a story, before buying anything
What this does: describes the real sequence. Where are you, what device do you have in your hands, what is the first thing you need, and what opens it.
Why prose and not a checklist: keep asking "and what opens that?" until the answer is something outside the house. The loop appears on its own, and writing it as sentences finds it faster than a list does.
# first-morning.md
# I am somewhere else, with a borrowed laptop.
# To reach the copy stored elsewhere I need ....... which lives .......
# To open THAT I need ....... which lives .......
# Keep going until the answer is outside the building you lost.2. Sort candidates into three honest groups
Be ruthless. The kit's value goes down as its size goes up, because size is what stops you refreshing it.
- Irreplaceable. Photographs, documents, anything only you hold. Goes in.
- Rebuildable, but expensive. Keys, settings, the notes that record why things are the way they are. Goes in, because weeks of your life is a real cost.
- Replaceable. Films, music, installers, anything you could download again. Stays out, and you write down that you chose this.
A gap you did not document looks exactly like a gap you did not notice, and in a year you will not remember which it was.
3. Scramble the whole drive, not individual files
What this does: makes the entire drive unreadable without the passphrase, so anything you add later is covered automatically.
Why whole drive: you cannot forget to protect a file you added in a hurry.
Use what your computer already came with. It has been examined by a lot of people and it will still exist in five years.
# Linux: scramble the whole device
sudo cryptsetup luksFormat /dev/<device>
sudo cryptsetup open /dev/<device> kit
sudo mkfs.ext4 /dev/mapper/kit
# macOS: an encrypted volume, made in Disk Utility
# Windows: BitLocker To Go on the removable drive
# works on all three: a VeraCrypt containerChoose something you can open on a machine that is not yours. An unusual tool you cannot install on a borrowed laptop is another lock with no key.
4. Make the passphrase something you can write by hand
What this does: gives you a passphrase that survives being copied onto paper and typed back correctly while you are upset.
Why words beat symbols here: six or more random words are strong enough and far easier to transcribe without error.
# six or more random words, from a genuinely random source
# write it in clear block capitals, and mark where the spaces go
# avoid characters that look alike by hand: zero and O, one and l and I5. Keep the secret and the drive in different buildings
What this does: puts the two halves of the kit in two separate places, neither of which is useful on its own.
Why buildings and not drawers: the thing you are planning for destroys or blocks access to one whole location.
# drive -> place A (a different building, a trusted person, a locker)
# paper -> place B (somewhere else again)
# neither place holds both, and neither alone is enoughWhat to write on the paper: a short note saying what it opens, and nothing at all about where that is. A found passphrase with directions attached is just a labelled key.
6. Restore from it, on a machine that is not yours
What this does: runs the whole sequence with nothing but the kit and the paper.
Why a borrowed machine: an untested kit is a theory. Your own computer already holds your credentials, so it cannot tell you whether the kit is complete.
# the test that counts
# 1. a machine with none of your credentials on it
# 2. open the drive using ONLY the written passphrase
# 3. open one file from each group you included
# 4. reach the backup stored elsewhere using only what the kit gave youStep four is the one that found my loop. Everything before it can pass while the plan is still broken.
7. Put a refresh date on it, and keep it boring
What this does: records what is in the kit, what you left out on purpose, and when it is next due.
Why it stays small: keys change, accounts move, contents drift. Pick an interval you will actually honour, and keep the job short by keeping the kit short.
# kit.md, stored with the drive
# contents : short list of what is in here
# LEFT OUT : films, installers, anything downloadable (on purpose)
# refreshed : date, and who tested opening it
# next due : dateThis protects you against losing a place. It does not protect against losing yourself. If nobody else knows the kit exists, your plan has a single point of failure wearing your face, and that is a different problem.
Related reading: a backup you have never tested is just a hope covers the copies themselves, and reading the screen in front of you instead of your memory of it is the companion habit, because recovery is exactly where remembered steps go wrong.
This page in the original Kyber Cypher voice: A backup you cannot reach is not a backup