Mac Care

A Mac Backup Strategy: Time Machine, Offsite Copy, Restore Drill

Set up Time Machine correctly, add an encrypted offsite copy, and run a 20-minute quarterly restore drill so a lost or ransomed Mac is a restore, not a loss.

By Editorial team

Published 13 min read

Ask this guide

Answers come straight from this guide’s text. Nothing is generated, and nothing you type leaves your browser.

0 of 3 doneSaved on this device only.

Two setups fail in predictable ways: no backup at all, and a Time Machine drive that lives in the same bag as the laptop. The first fails the day the SSD dies. The second fails the day the bag is stolen, or the day you find out the drive stopped finishing backups in the spring.

This guide builds a setup that survives both: Time Machine set up as Apple documents it, a second copy kept elsewhere, encryption secrets stored where a dead Mac cannot take them down, and a 20-minute quarterly drill that proves a restore works. Menu paths apply to macOS Ventura 13 and later, including macOS 27.

What 3-2-1 means when you own one Mac

The 3-2-1 rule says to keep three copies of your data, on two kinds of storage, with one copy offsite. Photographer Peter Krogh is typically credited with it, and DPReview points to his 2009 book The DAM Book. The UK's National Cyber Security Centre (NCSC) phrases it as "at least 3 copies, on 2 devices, and 1 offsite".

Two details trip people up. The three copies include the original, so a Mac plus one Time Machine disk is two copies, not three. And the rule "does not require any backup location to be offline", the NCSC notes, which matters for ransomware, covered below. A Time Machine disk beside the Mac shares its fire and theft risk; the offsite copy exists to break that link.

Time Machine setup: disk, format, encryption, exclusions

  1. Buy for capacity and dedicate the disk. Apple says to use a device with "at least twice the storage capacity of your Mac", used only for Time Machine. A 1 TB Mac wants a 2 TB disk. A Windows-formatted disk must be reformatted first.
  2. Add the disk. Open System Settings > General > Time Machine, click Add Backup Disk (+), choose the disk, and click Set Up Disk.
  3. Prefer APFS (Encrypted). Apple calls APFS or APFS Encrypted disks the preferred format. If a new disk is not APFS, Time Machine may offer to erase and reformat it, and accepting removes everything on it. A Mac OS Extended disk that already holds backups keeps working; see the warning if it is encrypted.
  4. Turn encryption on and set a backup password (see the encryption section).
  5. Exclude on purpose. Click Options, then +. Apple's reasons are saving space or skipping items you back up another way, such as a large virtual machine image or re-downloadable installers. Excluded items still appear in local snapshots.

Warning: Apple's notice about macOS 28 says Mac OS Extended (HFS+) will be supported only on unencrypted volumes, and its convert and decrypt fixes do not apply to encrypted Time Machine disks. It gives no release date. If Disk Utility (View > Show Only Volumes) lists your backup volume as both "Mac OS Extended" and "Encrypted", plan a fresh encrypted APFS disk. Our suggestion, not Apple's wording: add it as a second destination, keep the old disk until the new one holds the history you need, and erase the old one last.

What Time Machine keeps, and what it drops

Per Apple, Time Machine makes hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all earlier months. The oldest are deleted when the disk is full. Read that as a memory that thins out:

  • Last 24 hours: restore any hour. A file created and edited twice inside one hour keeps only its last state.
  • Last month: one version per day.
  • Older: one version per week, for as long as space lasts. A bigger disk is literally a longer memory.

On a MacBook, turn on Options > Back up on battery power if you often work unplugged, or hourly backups may not run.

Time Machine skips system files and apps installed with macOS, so a dead disk means reinstalling macOS before your files come back. It also keeps local snapshots on the Mac itself: about hourly for 24 hours, plus one before each macOS update. They sit on the same SSD, so they are not a copy. Apple says macOS counts their space as available and removes them as other tasks need it; our Mac storage guide covers when that does not go smoothly.

Check the backups from Terminal, not the menu bar

The menu bar tells you a backup ran; Terminal tells you which disk and when. These verbs are in the tmutil manual; man tmutil shows the copy for your macOS version. latestbackup and listbackups need root plus Full Disk Access (System Settings > Privacy & Security > Full Disk Access, add Terminal); the man page lists no privilege requirement for the other three.

# Configured destinations: name, kind, mount point, ID
tmutil destinationinfo

# Newest backup on one disk, timestamp only (YYYY-MM-DD-HHMMSS)
sudo tmutil latestbackup -d "/Volumes/<backup disk name>" -m -t

# Every completed backup on that disk, timestamps only
sudo tmutil listbackups -d "/Volumes/<backup disk name>" -m -t

# Back up now and wait until it finishes
tmutil startbackup --block

# Is a folder being skipped? Prints [Excluded] or [Included]
tmutil isexcluded ~/Projects ~/Documents

The -m flag mounts the backups, which APFS disks need: Eclectic Light's Howard Oakley notes that apps and Terminal must mount APFS backup snapshots before they can reach them.

Our rule: if the newest backup is over a week old while the disk has been attached, the setup is broken. Apple describes hourly backups.

When the newest backup is old

Work down this list and stop at the first fix that holds:

  1. No destination. destinationinfo prints tmutil: No destinations configured. Add the disk (setup step 2).
  2. Disk not attached or mounted. Reconnect it and check Disk Utility; First Aid there is general repair, not an Apple Time Machine step.
  3. Backup Frequency set to Manually. Apple's snapshots page names this option under Time Machine Options on Ventura 13 or later.
  4. An error in Time Machine settings. Read it before changing anything.
  5. Network destination. A NAS must support Time Machine over SMB, and Apple says AFP isn't supported in macOS 27 or later.
  6. Disk full. Compare the oldest and newest listbackups entries (the drill's Reach row).

Add the offsite copy

Three ways to get a copy off the premises

Option Strong at Weak at Pick it when
A second Time Machine disk, kept elsewhere No subscription, fast local restores, disconnected by design Only as fresh as your last swap Upload speed is slow or the data is large
Cloud backup service (versioned uploads) Automatic, far away, versioned Slow first upload; short version history; one more account You have upstream bandwidth and want no chores
Sync service such as iCloud Drive Access from anywhere Deletions and overwrites propagate Never as the only copy

With two Time Machine disks, Apple says Time Machine "rotates the backup schedule among the disks", each disk gets everything changed since it was last used, and the exclusion list applies to all of them. Krogh says "someplace easy is better than someplace really secure" for the offsite drive, and adds that keeping it updated "can be difficult", which is why he favours cloud backup for working files. Encrypt a disk kept at an office or a relative's home (see the backup password below).

iCloud Drive is sync, not backup. Apple says deleting a file on iCloud.com also deletes it from all your devices with iCloud Drive turned on, and deleted files stay recoverable for 30 days: a safety net, not an archive. Treat other sync tools the same way until their documentation shows a versioned restore, and test it.

Storage optimization adds a catch. Apple says the Store in iCloud recommendation can optimize storage by "keeping only recently opened files on your Mac when space is needed". Our reading: a backup can only copy what is actually downloaded.

Worked example: how long the first upload takes

Say a MacBook has a 1 TB SSD with 612 GB used; the offsite upload carries only those 612 GB. With decimal GB, hours ≈ GB × 2.22 ÷ upstream Mbps (that is 8000 ÷ 3600). The derated column divides by 0.8 first, so the constant becomes 2.78.

Upstream speed At full line speed At about 80% of line speed (our assumption)
10 Mbps 136 hours (5.7 days) 170 hours (7.1 days)
20 Mbps 68 hours (2.8 days) 85 hours (3.5 days)
50 Mbps 27 hours 34 hours
100 Mbps 13.6 hours 17 hours

Real uploads share the connection with everything else, so plan on the right-hand column. Our rule: if the derated first upload takes longer than about a week, start with the rotated disk and let the cloud copy seed in the background.

Ransomware and the version-history gap

Ransomware tries to reach your backups too. The NCSC reports it encrypting connected USB and network drives holding backups, and CISA's #StopRansomware guide says to "maintain offline, encrypted backups of critical data". A Time Machine disk that is always plugged in is a connected backup. The rotated second disk is offline by design. If it happens, CISA's checklist starts with isolating affected systems. Our reading: also detach every backup disk, and never reattach one to a Mac you have not cleaned.

Versioning has a time limit, and silent damage is found late. Backblaze, as one example, keeps 30 days of version history by default and offers one year or forever as options. A document corrupted in week one and opened in week seven has no good version left under the default, while a weekly Time Machine version may still hold one. Match the history window to how long you take to notice.

Encryption: three secrets to keep somewhere other than the Mac

Encryption protects a stolen disk and creates a new way to lose everything. Record three secrets:

  • FileVault. Apple says data on a Mac with Apple silicon or a T2 chip is encrypted automatically, and turning on FileVault (Privacy & Security > FileVault) adds a layer that keeps out anyone without your login password. Check which recovery method you chose: Apple says to keep a recovery key somewhere other than your encrypted startup disk; if you chose your iCloud account instead, note how you would sign in from another device. Lose the login password and the recovery key and Apple says your files and settings are lost forever.
  • The Time Machine backup password. Apple says you must provide it to restore from an encrypted backup, and its page describes no way to recover a forgotten one, so assume there is none. A copy that lives only in the keychain of a dead or stolen Mac does nothing for the replacement.
  • The offsite account and any encryption key the service gave you.

Tip: Store all three in a password manager or on paper, then retrieve them with the Mac shut: from your phone's password manager, or from the paper. A secret reachable only from the machine you are recovering is not backed up.

The quarterly restore drill

A backup you have never restored is a hope. This drill takes about 20 minutes. Quarterly is our pick; CISA says only to test backups "regularly". Log the date, what you restored, how long it took, and what failed.

Check Pass looks like If it fails
Freshness The latestbackup command above prints a timestamp from the last week Work down the stale-backup list
Canary file Create ~/Desktop/backup-drill.txt, run tmutil startbackup --block, delete the file, then restore it in Time Machine (Spotlight finds it in the Other folder; a Desktop item needs no Finder window open). It returns and opens Confirm the disk is mounted with tmutil destinationinfo, then repeat
Old version In Time Machine, step back at least eight weeks, restore one real file, and open it. Restored items return to their original location, Apple says, so if the file still exists, expect a clash prompt and keep both Check Reach; vanished history cannot be restored
Reach The listbackups command above shows an oldest entry about as old as you expect The disk is full and shedding history: buy a bigger one or exclude large items
Offsite One real file restores from the cloud service or offsite disk (Option-click the Time Machine menu bar icon, then Browse Other Backup Disks), and the last backup date is recent Check sign-in, whether the last upload finished, and that files are downloaded
Secrets All three retrieved without the Mac Write down the missing one today

Give the drill a trigger instead of leaving it to memory. An if-then plan such as "if it is the first Saturday of January, April, July, or October, then I run the drill" does that.

What recovery from a dead Mac looks like

Apple's restore guide runs in this order: reinstall macOS if the Mac will not start normally; connect the backup disk; open Migration Assistant and choose to transfer from a Time Machine backup; pick the disk, then a backup (expand the list for an older one); choose categories; set account passwords. Apple says large transfers "might need hours" and gives no estimate. A cloud restore is a download, so the upload formula applies with your download speed. Once a year, or when you replace a Mac, do the full restore and time it.

Where to start this week

  • Today: run tmutil destinationinfo and sudo tmutil latestbackup; no disk or an old date sends you to the stale-backup list. Check the disk's format in Disk Utility too, because encrypted Mac OS Extended needs a plan before macOS 28.
  • This week: record the three secrets, then start the first upload or buy the second disk.
  • This month: run the drill once and calendar the next one.

Finish a backup before any major macOS upgrade; our slow-after-update guide starts from one.

We build Tend, a free macOS app (macOS 11 or later) whose Resilience Center shows Time Machine freshness, FileVault status, and APFS snapshots read-only. Every step above works with System Settings and Terminal alone.

Frequently asked questions

Is it safe to unplug the Time Machine disk between backups?

Yes, if you eject it first; Apple says to eject the backup disk or shut down your Mac before disconnecting. Nothing is written to that disk while it is away. The hourly local snapshots Apple describes sit on the Mac's own SSD and are kept for 24 hours, so they cover about the last day and share the Mac's fate.

Can I use one drive for Time Machine and for ordinary files?

Apple says to use the disk only for Time Machine backups, not for storage of other files. If you must share one drive, Apple's setup page says you can add an additional APFS volume, so one volume holds backups and the other your files. It is still one physical drive, so a failure takes both.

Is a second rotated disk enough, or do I need cloud backup?

It depends on how reliably you will swap it. Krogh says an offsite drive is hard to keep current. A rotated disk works if the swap is tied to the quarterly drill; otherwise add a cloud copy. Backblaze reported an annualized failure rate of 1.36% for 2025 across 344,196 data-center drives. Our reading: external hard disks are closer to that population than a laptop SSD is, so one backup disk is a single point of failure.

Sources and further reading