ExsIT

IT solutions & innovation — support, security, AI for SMEs

Backup: rotating two external drives

Backup: rotating two external drives

Daniel Platteau

Updated on 11 November 2026. Prices checked at Coolblue on 11 November 2026.

In short: ransomware encrypts everything that is connected, including the backup drive. The cheapest defence: two external drives, one connected for the automatic backup, the other unplugged and stored elsewhere, swapped every week. Count on about €300 for two 4 TB drives, with no subscription.

Why a connected backup is not enough

Many small businesses do have a backup: a USB drive permanently connected to the PC or server, copying files every night. That is better than nothing. But against ransomware, that drive is useless: the malware encrypts everything it can reach, and a connected drive is a reachable drive.

Cybersecurity authorities keep saying it: you need a disconnected copy. ANSSI, the French cybersecurity agency, asks for offline backups to be made "regularly and without fail". The French Cybermalveillance service advises unplugging the backup medium after use.

After 25 years of work with SMEs, including ransomware incidents, I keep seeing the same thing: the business that gets back on its feet quickly is the one that had a drive in a drawer.

Rotating two drives, in practice

  • Drive A: connected, it receives the automatic backup (every night or every day).
  • Drive B: unplugged, stored elsewhere, ideally away from the office (at home, in a safe).
  • Every week, for example on Friday, you swap: B is connected, A goes into the drawer.

At worst, you lose a week of work, not ten years. And the drive stored off-site also protects you against theft, fire and water damage.

External hard drives sold at Coolblue Two external drives for a backup out of ransomware's reach. View at Coolblue Affiliate link

Affiliate link: if you buy through this link, ExsIT receives a small commission at no extra cost to you. See our affiliate disclosure (in French).

The options compared

Option Cost Time Risk against ransomware
Do nothing €0 0 Everything is lost, or you negotiate a ransom
A single drive, always connected ~€150 None The drive is encrypted with everything else
Two drives in rotation ~€300 2 minutes a week At worst, one week lost
NAS + unplugged drive or off-site copy €600 and up Set up by a professional The most comfortable, from 5 workstations

Indicative prices for entry-level 4 TB external drives at Coolblue (about €150 each on 11 November 2026), installation not included.

What I check before buying

  • Capacity: at least twice the volume to back up, to keep several versions. 4 TB is enough for most small organisations.
  • Two identical drives: same model, same capacity; the backup software handles them more easily.
  • A desktop or portable drive: a portable drive (powered by USB) is easier to store and carry; it is my usual choice for rotation.
  • Warranty: 3 years minimum.
  • Encryption: if the drive leaves the office, encrypt it (BitLocker on Windows Pro). A lost drive must not become a data leak.

Example: a three-person firm (illustrative case)

A three-person accounting firm keeps its files on a small server. Automatic backup every night to drive A; on Friday, the manager takes drive A home and brings drive B back. The day a workstation is infected and the server is encrypted, the systems are cleaned and reinstalled, and the data is restored from the drive stored at her home. The firm loses three days of data entry, not its archives, and pays no ransom.

Common mistakes

  • Forgetting the swap: put a reminder in the calendar. A rotation stopped six months ago protects very little.
  • Never testing a restore: once a quarter, restore a random file. A backup that has never been tested is only a hope.
  • Storing both drives in the same place: a fire or a burglary takes everything.
  • Confusing sync with backup: OneDrive or Dropbox also copy encrypted or deleted files.

Why does a backup drive that is always connected not protect against ransomware?

Show the answer

Answer: Because ransomware also encrypts the drives it can access

Ransomware encrypts everything it can reach. Only a disconnected copy, like the second drive of a rotation, stays intact.

For your IT person

  • Software: any imaging or file backup tool that handles several target drives; the tools we use are presented in our complete backup guide.
  • Label the drives (A and B) and keep a small log of the swaps.
  • Enable backup failure notifications, sent to someone who reads them.
  • Beyond a few workstations: a NAS with snapshots, plus a drive in rotation or an off-site copy. See also the common pitfalls of an SME PC fleet.

Free first contact: we look at what you back up today, then propose a simple plan.

Sources

ANSSI. (2023). Les essentiels : sauvegarde des systèmes d'information. Agence nationale de la sécurité des systèmes d'information. https://cyber.gouv.fr/sites/default/files/document/2023_les-essentiels_sauvegarde_vf.pdf

Coolblue. (n.d.). External hard drives, 4 TB [page consulted on 11 November 2026]. https://www.coolblue.be/fr/disques-durs-externes/capacite-de-stockage-4-to

Cybermalveillance.gouv.fr. (2019). Les sauvegardes : fiche pratique. https://www.cybermalveillance.gouv.fr/medias/2019/11/Fiche-pratique_sauvegardes.pdf

Related articles

← Back to articles