How to build a 3-2-1 backup for Android with SyncGallery

A phone sending separate copies to a home storage server and an offsite cloud

What 3-2-1 means

The 3-2-1 rule is a simple way to avoid trusting one device, one disk, or one building with your only copy of something important:

3 copies: the original plus two backups.
2 types of storage media: so one kind of failure does not affect everything.
1 copy offsite: physically away from the original.

The Canadian Centre for Cyber Security recommends exactly this arrangement and also recommends testing the recovery process.

There is a fitting bit of photography history behind the rule. The 3-2-1 formulation is widely attributed to photographer Peter Krogh, who presented it in The DAM Book: Digital Asset Management for Photographers, first published by O'Reilly in 2005. It was advice for photographers protecting growing digital image archives, including RAW files, before it became common guidance across the IT industry. Krogh's later backup overview for digital photography still recommends a full 3-2-1 backup for images in their long-term home.

For an Android phone, a practical version looks like this:

Working copy: Android phone.
Local backup: SyncGallery rule 1 -> PC or NAS at home.
Offsite backup: SyncGallery rule 2 -> cloud storage outside your home.

The phone contains the files you use. A PC or NAS gives you a nearby copy that is fast to restore. A cloud account gives you a copy outside your home, so losing the phone and the local storage in the same incident does not remove every copy.

This works for a camera folder, several photo albums, or a regular folder such as Documents.

If you want the simplest practical recipe, use the phone as the working copy, an SMB share on a PC or NAS as the nearby copy, and one of SyncGallery's direct cloud connections as the offsite copy. Create two folder-level Just upload to cloud rules for the same source, disable remote deletion in both, then test restoring one file from each destination.

First, decide what counts as a copy

The three copies must be genuinely separate.

The same file in two folders on one disk is still vulnerable to that disk failing.
A phone and a NAS in the same home are two copies, but neither is offsite.
A self-hosted Nextcloud server running on that same NAS is convenient, but it is still onsite.
A cloud folder that is only a view of the same NAS storage is not a third independent copy.

Choose the local destination

SyncGallery can connect directly to a PC, NAS, or self-hosted server through SMB, SFTP, FTP/FTPS, WebDAV, or Nextcloud. The best choice depends on what your storage already supports.

SMB: the simple choice on a home network

Choose SMB when your Windows PC or NAS already exposes a shared folder and the phone will upload while it is on your home network. It is usually the shortest path from phone to local storage.

Keep SMB on the local network or reach it through a properly configured VPN. Do not expose normal SMB port 445 directly to the internet. Microsoft recommends blocking inbound SMB access from the internet.

SyncGallery can browse and transfer files over SMB, but the SMB integration does not provide server-generated media thumbnails. Whether you have snapshots, a recycle bin, or version history depends on the PC or NAS behind the share.

Nextcloud: more setup, more comfort

If you already host Nextcloud, or you are comfortable maintaining it, use SyncGallery's dedicated Nextcloud connection instead of treating the server as generic WebDAV.

That connection can request server-generated thumbnails, so browsing remote photos is more comfortable and does not require downloading every full image just to show a preview. Nextcloud documents how its preview system generates thumbnails. Exact preview support still depends on the server configuration and file type.

Nextcloud can also add recovery features on the server side. Its Versions app can keep older file contents, and its Deleted Files app can retain deleted items. These features have storage limits and configurable retention, so verify how your own server is configured.

Nextcloud is not automatically offsite. If it runs on the same NAS in the same home, treat it as the local copy.

SFTP, WebDAV, and FTPS: useful alternatives

Choose SFTP when the server already provides SSH access. Choose WebDAV when the NAS, server, or storage provider exposes a secure HTTPS endpoint. Choose FTPS when FTP is the available option but the server supports TLS.

For WebDAV, use an https:// address. The WebDAV standard warns against sending passwords over an insecure connection, and Nextcloud also recommends HTTPS for WebDAV.

Avoid plain FTP unless you are on an isolated, trusted network and have no better option. Standard FTP sends passwords and file data without encryption, as explained in RFC 2577. SyncGallery supports FTPS Explicit and FTPS Implicit, which are better choices when the server offers them.

Generic SMB, SFTP, FTP/FTPS, and WebDAV connections do not give SyncGallery a server thumbnail API. They can still transfer the original files. Version history and deleted-file recovery, if any, come from the storage system behind the protocol.

Choose the offsite destination

SyncGallery has direct connections for OneDrive, Google Drive, Dropbox, Yandex Disk, and pCloud. It can also use another provider when that provider gives you compatible SFTP, FTP/FTPS, or WebDAV access.

If you already pay for a cloud service and trust it, that is usually the easiest place to start. Check four things before relying on it:

You have enough space for the complete folder, including future growth.
Your account uses a strong unique password and multi-factor authentication.
You know whether the provider keeps deleted files and older versions.
You have successfully downloaded and opened a restored test file.

Version history is valuable because an upload-only rule can still replace a good remote file with a later damaged or unwanted edit. Current policies differ:

OneDrive version history supports all file types, including photos and videos, and Microsoft currently states a 30-day retention period.
Google Drive says a file version may be permanently deleted after 30 days or after 100 newer versions unless you select Keep forever.
Dropbox currently provides 30, 180, or 365 days of version history depending on the plan.
Yandex Disk also offers file history, but availability and retention can depend on the account and plan. Check the policy shown for your account before relying on it.

These policies can change. They belong to the storage provider, not to SyncGallery.

Create the first rule for the PC or NAS

Start with a small non-critical folder so you can see every setting and test a restore.

Add the PC, NAS, or Nextcloud account to SyncGallery.
Create a new rule and choose Just upload to cloud. The UI uses the word cloud for both cloud services and network storage.
Choose Sync Folder or Album(s) which I select below so new matching files are picked up automatically.
Select the device folder. For photos this may be DCIM/Camera. For other files it may be Documents.
Select a dedicated destination folder on the PC or NAS.
Enable Monitor sub-folders if the source contains folders below it.
Turn off Delete in cloud when device file deleted.
Save the rule and review the first scan before approving its planned uploads.

Turning off remote deletion is important. If a photo is deleted from the phone by mistake, the local backup copy should remain available.

Create the second rule for offsite cloud

Create another rule for the same source folder, but select the cloud account and a dedicated cloud folder as the destination. Use the same upload-only, folder-level, subfolder, and deletion settings.

This is a separate rule, so each destination has its own scan, task history, errors, and first-sync preview. A successful upload to the NAS does not prove that the cloud upload also succeeded. Check both rules.

SyncGallery Rules screen showing the Documents folder uploaded separately to an SMB server and Dropbox — Two independent upload-only rules protect the same Documents folder: one sends files to local SMB storage and the other sends them to Dropbox.

Configure photos, videos, or any other folder

For a media library, choose Photos & videos only. If your editor creates sidecar metadata, choose Photos, videos, and sidecar metadata (XMP).

For Documents or another general folder:

Choose All files matching custom patterns.
Add the include pattern * to include files with and without extensions.
Add exclusions only when you understand what will be omitted. For example, *.tmp excludes temporary files.
Grant All Files Access when Android asks. SyncGallery requires it to process non-media files across arbitrary folders.

Do not use *.* when you also need files without an extension. In SyncGallery, *.* means only names that contain an extension.

Decide what should happen to edited files

The setting Update cloud files when modified on device deserves a deliberate choice on both rules.

On: later edits are copied to the destination. This keeps the backup current, but the new content can replace the earlier remote content. Destination-side snapshots or version history become important.
Off: the first uploaded content remains unchanged, but later edits are not backed up by that rule.

For most people, keeping it on and choosing destinations with version history or snapshots is the more useful balance. It protects both the current file and recent earlier contents.

You can also enable Re-upload to cloud if file was deleted there when the phone is authoritative and you want SyncGallery to restore a remotely deleted current copy. Do not enable it if you expect to manage or intentionally remove files at the destination.

For the difference between current-state synchronization and recoverable history, see Sync vs backup: what SyncGallery does, and what it does not.

SyncGallery upload-only settings with remote deletion disabled and remote updates enabled — Remote deletion is disabled, while edited device files are uploaded and remotely deleted copies are created again.

Test the setup before trusting it

A backup is useful only if you can restore it. After both first scans finish:

Check the task history for each rule and confirm there are no failed uploads.
Open the NAS or PC destination independently and confirm the test files exist.
Sign in to the cloud through its website and confirm the same files exist there.
Download one file from each destination to another folder.
Open the restored copies and verify that a photo, video, or document is readable.
Edit a test file and confirm the update behavior matches your choice.
Delete a test file from the phone and confirm both backup copies remain.
If the destination offers version history, restore an earlier test version too.

Repeat a small restore test from time to time. Also check SyncGallery after password changes, server updates, long periods away from the home network, or Android battery-setting changes.

What this setup protects, and what it does not

This arrangement protects against common failures:

A lost or broken phone can be restored from the NAS or cloud.
A failed local disk still leaves the phone and offsite copy.
A fire, theft, or electrical event at home still leaves the offsite copy.
A normal deletion on the phone does not propagate when remote deletion is disabled.

It is not a complete versioned backup system by itself. SyncGallery tracks current file relationships and transfer history, but it does not maintain its own restore points or retention catalog. A corrupted or unwanted edit can still reach both destinations when remote updates are enabled. Use NAS snapshots, Nextcloud Versions, or cloud version history when earlier file contents matter.

The result is best understood as two independent, backup-like upload rules forming a practical 3-2-1 layout. The last step is the one people most often skip: prove that you can restore a file before the day you actually need it.