It is generally recommended to try to follow the 3-2-1 rule: at least 3 copies, on at least 2 devices, with at least one off-site copies.

For example: 1) your computer 2) a local backup on an external disk 3) a cloud to store another backup

It requires sometimes complex setups, but it is a good practice. However, what this rule does not say, but is very important (actually more important), is that your backups should ABSOLUTELY be encrypted. Otherwise any attempt to implement full disk encryption will be useless, since anyone could just grab the entirety of your data by just accessing your backups.

In this page we are reviewing several tools used to make backups.

1. Some of them should be implemented before a dramatic configuration change to be sure that you can switch back to a working setup in case of a dramatic incident. Clonezilla is an open source project that allows to do this. It is cross platform except that M1 silicon Macs (basically any recent Mac laptops) cannot use it. Mac has a build in proprietary alternative called Time Machine. It is rather easy to use.
2. Some of them should be implemented on your “regular” folders (i.e. not your programs) quite often. I will propose to use restic for this. It is open source and cross platform.

you should ABSOLUTELY do it before any operation on your disks or partitions (such as the one presented here for instance) : there is a significant risk to destroy ALL your data.

Clonezilla is a free, open source software that allows to make a disk image and save it in a compressed encrypted file to be stored on an external drive. With this, you will be able to restore your whole disk in its current state where it works fine.

For this, you will need:

1. An external hard drive to store the backup. I suggest using an external SSD with a capacity a bit bigger than your whole drive capacity. You do not need to encrypt this disk, as the backups themselves will be encrypted.
2. An external USB stick to install CloneZilla. It should be at least 1GB and be used only for CloneZilla

First, download the file as an iso.

This step requires that you have installed GPG. If you did not, please find the instructions here.

Then, verify the download, using the following commands:

wget https://clonezilla.org//downloads/stable/data/CHECKSUMS.TXT
wget https://clonezilla.org//downloads/stable/data/CHECKSUMS.TXT.gpg
gpg --keyserver hkp://keys.openpgp.org --recv-key 667857D045599AFD
gpg --verify CHECKSUMS.TXT.gpg CHECKSUMS.TXT

The output should show the line:

gpg: Good signature from "DRBL Project (Diskless Remote Boot in Linux) <drbl@clonezilla.org>" [unknown]

You then have verified that the file CHECKSUM.TXT has been encrypted by the owner of the private key of the clonezilla project. You can then compare the checksum of your file with the content of CHECKSUMS.TXT:

sha256sum clonezilla-live-3.2.1-9-amd64.iso

Replace the filename with the actual file you downloaded if it is another version. Check that the output of this command is part of the output of:

cat CHECKSUMS.TXT

If so, you are sure to have the right file. You can then proceed to flash you USB key. I recommend using Balena Etcher, which is Open Source, user friendly and cross platform.

you can then follow the clonezilla guide to backup your whole image to an encrypted image stored in your unencrypted disk. Do not forget to tick the “encrypt your image” option, and secure it with a strong passphrase that you will remember.

This second backup tool is to be used regularly to backup your Home directory (for example the /C/Users/YourUsername directory in windows, or the /home/yourusername on linux), as well as any file folder that is not your installed programs (like an extra disk used only to store files, videos, etc.), and can also be used to backups smaller folders.

It is called Restic

Once this is done, you can do another backup of your /home, which contains all your regular files. For this you can use the software backintime. You can install it with:

sudo apt install backintime-qt

Before launching it, we need to decrypt the encrypted disk, and mount the logical volume we intend to use:

sudo cryptsetup luksOpen /dev/sdb2 cryptsetup
sudo vgchange -ay
sudo mount /dev/mapper/vgbackup-home /mnt

now everything written on /mnt on your computer will be written on your disk.

You can then launch backintime with:

sudo backintime-qt

you can then configure it to save things in /mnt:

And then click on “Take snapshot” and wait for it to finish:

you can then unmount and remove your backup disk:

sudo umount /mnt
sudo vgchange -an vgbackup
sudo cryptsetup luksClose cryptodisk