Decide what you cannot afford to lose
List important documents, photos, contacts, study work, business records and recovery instructions. Check where they actually live. Files on a phone may not be included in a laptop backup, and an app's backup may need its own password to restore.
Keep a separate, protected copy
Use a maintained backup service, an external drive or both. Keep at least one copy separate from the everyday device. Disconnect an external backup drive after use so a compromised computer cannot readily alter it. Protect sensitive backups with encryption and keep the recovery key safely elsewhere.
Cloud synchronisation is useful, but deleting or damaging a file can sync that change too. Check whether the service provides version history, deleted-file recovery and how long it retains them. Secure its account with a unique password or passkey and MFA.
Set up a backup routine
Choose the folders, apps and device data you need to preserve.
Choose a backup destination with enough storage and a recovery method you understand.
Run the first backup and check its completion status.
Schedule future copies according to how much new work you could afford to lose.
Restore a small sample to a different location and open it. Repeat this check periodically.
Restore safely after an incident
If malware is suspected, clean or rebuild the affected device with trusted help before restoring. Choose a backup from before the suspected compromise and scan restored files. Do not overwrite your only remaining copy while troubleshooting. Follow your IT team's instructions for organisational data.
Before replacing a phone
Check that photos, contacts, messaging histories and authenticator recovery are available on the replacement. Some financial apps and security keys need separate re-registration. Keep the old device secure until you have verified the transfer.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.