Your expert in backup and data protection!The solution tailored to your needs
How do you back up a NAS?
A NAS is a place where files live, not a backup. You back it up by copying its shares and its configuration to another system, outside that NAS, with several restore points. Otherwise a disk failure, theft or encryption of the share takes the only copy.
Key points
- RAID keeps you running when a disk dies; it also replicates deletions and encryption.
- Local snapshots are a good first layer, but they disappear with the NAS.
- Copy the shares and the configuration (users, permissions, shares, tasks).
- CERT-MU recommends an off-site copy; also keep at least one isolated offline copy.
- Restore a folder from the external copy every quarter, not from the local snapshot.
Why the NAS’s RAID is not enough
RAID (or SHR on Synology, and its equivalent on QNAP) keeps you running when a disk dies. It faithfully replicates a deletion, a format and ransomware that encrypts the files on the share. The NAS recycle bin and local snapshots help against a recent mistake. They are lost with the NAS in a fire, and they are often accessible to the same administrator account that the attacker uses.
The ANSSI, France’s national cybersecurity agency, makes the point in its ransomware guide: backups must cover all data, including that of file servers, and at least the most critical backups must be disconnected from the information system. A NAS plays exactly this file server role.
Local snapshots remain a good, short first layer for restoring a file the same day. They do not replace the external copy.
| Protection | Disk failure | Accidental deletion | Ransomware | Fire, theft |
|---|---|---|---|---|
| RAID / SHR | Yes | No | No | No |
| Recycle bin, local snapshots | No | Yes, short term | Sometimes | No |
| Second NAS on site | Yes | Yes, if versioned | Rarely | No |
| Encrypted external copy with version history | Yes | Yes | Yes, if isolated or immutable | Yes |
What to copy
- Shares containing working documents, profiles, scans and active archives.
- Folders of the NAS applications (backups it already receives from other computers, photos, repositories) if this data exists nowhere else.
- The NAS configuration: users, permissions, shares, tasks. Rebuilding the permissions of forty users from memory takes longer than copying the files back.
- Databases or virtual machines hosted on the NAS, with a consistent method, not just a copy of the disk file while it is running (see How should you back up a virtual machine?).
There is no need to back up the NAS operating system like a Windows server image: if it fails, you replace the device and reapply the configuration plus the data. Unless the hardware is identical and the procedure has been tested, the manufacturer’s image is rarely the safest route.
How the copy should be made
In its backup plan guideline, CERT-MU stresses off-site copies and regular restore tests, and the Data Protection Act 2017 (section 31) requires appropriate security measures against the loss or destruction of data. Add at least one isolated offline copy and protect the backups to the same level as the original data. Applied to a NAS:
- To another site, or to an outsourced service, encrypted before it leaves the network.
- With several restore points, not a synchronisation that immediately propagates encryption.
- With a backup account that is not allowed to erase the remote history.
- An immutable copy if the documents on the NAS are the company’s memory.
- An alert if the nightly job did not run. NAS devices send emails that nobody reads any more: the alert must reach a named person.
Synology (Hyper Backup, Snapshot Replication) and QNAP (Hybrid Backup Sync) can send a copy to another NAS or to a cloud. The feature exists. It is often not set up, or it points to a second share on the same device.
For a copy on a USB drive, disconnect the drive after each backup and keep it in a different location: a drive permanently connected to the NAS will be encrypted along with it.
Minimum test
Every quarter, restore a recent folder from the external copy, not from the local snapshot. Once a year, check that the configuration (one user, one share) can be rebuilt. CERT-MU also recommends regular restore tests: a backup that has never been checked offers no guarantee.
At WeDoBack
NAS devices are among the systems backed up, alongside servers and workstations; the page dedicated to health data mentions Synology and QNAP NAS devices. Data is encrypted before it is sent, with a key held by the customer, then stored on servers dedicated to backup, separate from the NAS and replicated in several European countries (transfer outside Mauritius governed by section 36 of the Data Protection Act 2017). The NAS is a source to include in the subscribed volume, with SMART at 49.99 € excl. VAT per TB per month or with INTEGRAL depending on the tier. For sizing, WeDoBack publishes a rule of thumb: current volume multiplied by three, then adjusted after a week of use. The IMMUTABLE offer can be added for documents that must be protected from any deletion.
Frequently asked questions
My NAS uses RAID 1. Is that a backup?
No. RAID 1 writes the same data to two disks at the same time: if a file is deleted or encrypted, it is deleted or encrypted on both. It protects against a disk failure, not against human error, theft, fire or ransomware.
Is a second NAS in the same office enough?
It is better than nothing if the first one fails, but it is not enough against fire, theft or ransomware that uses the same administrator account on both devices. CERT-MU recommends keeping an off-site copy, away from the machines that host the data.
Should the NAS system itself be backed up?
Rarely as an image. If it fails, you replace the device, reapply the exported configuration and then restore the data. Do, however, keep the configuration export up to date and stored off the NAS.
Further reading
Sources
Documents consulted in October 2026.
- Introductory Guide to the Data Protection Act 2017 — Data Protection Office (Mauritius)
- Guideline on devising a personal backup plan (CMSGu2017-03) — CERT-MU
- Ransomware attacks, everyone is concerned – How to anticipate them and respond to an incident (ANSSI-GP-077, August 2020, in French) — ANSSI, France’s national cybersecurity agency
- Backing up information systems – The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025, in French) — ANSSI, France’s national cybersecurity agency
- Offers and prices — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.