Every defence layer is a probability. The offline backup is a certainty: ransomware cannot encrypt a copy it cannot reach. This is the least glamorous page in the set, and the one that decides whether an attack is a bad afternoon or a lost business.
Ask incident responders what actually saved a company and the answer is rarely a heroic antivirus moment. It is a backup copy that the ransomware could not touch. Modern ransomware deliberately hunts backups first - it deletes shadow copies and encrypts any connected backup drive it can write to. That is why the word offline does all the work in this guide. A backup on a drive that is plugged in, mounted and writable at the moment of attack is not a last line. It is just more data in the same fire.
The rotation that works well in small offices: two external drives, swapped weekly, so one is always off-site or in a drawer while the other works.
A backup you have never restored from is a hope, not a backup. Once, this month, do the boring test:
Ten minutes. This single habit catches wrong-folder backups, corrupted drives and expired cloud accounts while there is still time to fix them calmly.
Your daily backup destination will usually be reachable by the PC, so harden what you can: give the backup its own credentials where the tool supports it, do not browse the web or open attachments from the machine that hosts office backups, and keep Windows and its Defender fully on for that machine as well. None of this replaces the offline copy - it just raises the chance that both layers survive.
With an offline copy in place, the ransomware conversation changes completely. The infected PC gets disconnected, wiped and reinstalled clean - a tedious but ordinary job - and the data comes back from the copy the attacker never touched. No negotiation, no payment, no dependency on anyone's promises. That is why every honest ransomware guide, including this set, ends at the same place: layers to prevent, and an offline backup for when prevention has its one bad day.
See the test setup and the defences in action on the Technical Anshu channel, then come back and apply the settings on your own PC.
Watch Full VideoOnly if it keeps version history and you can roll files back to versions from before the attack. Plain sync mirrors deletions and encryption within minutes. Versioned cloud storage, or an unplugged drive, is what counts as unreachable.
Match it to how much work you can afford to re-do. Daily for a working office, weekly for most home PCs. The rotation of two drives - one connected, one stored away - is the simplest pattern that keeps a recent copy permanently out of reach.
Shadow copies on the same machine are usually the first thing an attack removes, which is exactly why they are never counted as the backup in this guide. The offline drive or versioned cloud copy is unaffected by what happens on the infected PC.