The idea
An
offline backup is a copy not continuously writable from the computer you are protecting. An external drive unplugged after a verified backup is a familiar example. It reduces the chance that ransomware or an accidental deletion on the computer will also damage that copy.
A practical routine
Connect the drive, run the backup, check completion and restore a sample file to a different folder. Then safely disconnect and store the drive. Protect its encryption password separately. CISA's
ransomware guidance calls for offline, encrypted backups and regular restore tests.
What it cannot fix
An offline copy can be stale, damaged or lost in the same fire as the computer. Pair it with another location or service and check the date of its last successful backup. A copy you never try to open is an untested hope. Keep the drive disconnected after checking the restored sample, and label it with the date of the latest successful run.
