Local Backup Smackdown: External Drive vs. NAS — Which Actually Restores?

The Contrarian Take: Your External Drive Backup Might Be a False Security

Everyone tells you to back up locally. Buy an external drive, plug it in, run a full backup, and sleep well. I've been that guy — and I've also been the guy who lost a week of work because the external drive sat unplugged on a shelf, and the 'backup' was two months old. The truth is, local backup isn't a single solution. It's a spectrum, and the cheapest option is often the worst. In this head-to-head, I'm pitting the classic external drive against a networked-attached storage (NAS) with snapshots — two popular local backup approaches — and I'm going to be blunt: for most people, the NAS wins, but not for the reason you think.

Round 1: Recovery Point Objective (RPO) — How Much Data Can You Afford to Lose?

RPO is the maximum acceptable data loss measured in time — the latest point to which data can be restored (NIST glossary). For a local backup, your RPO is determined by how often you back up. With an external drive, you're likely doing manual full backups weekly, if you're disciplined. That means your RPO is roughly a week — you could lose seven days of work. A NAS with snapshot support, on the other hand, can take snapshots every 15 minutes if configured that way, giving you an RPO of 15 minutes. NIST SP 800-209 advises that snapshots should be configured to meet the RPO of the target datasets — for example, if you need no more than five minutes of lost data, snapshot interval should be five minutes or less. I've seen NAS units default to hourly snapshots, which is a huge improvement over weekly external drives. But here's the kicker: snapshots are not backups. NIST SP 800-209 defines a snapshot as a storage-efficient point-in-time copy that stores only changed blocks, and it notes that if the source data is unavailable, the snapshots will often not be usable either. So while snapshots give you a great RPO, they're not a standalone backup — you still need a real backup, which is where the external drive can play a role. But for RPO alone, NAS snapshots win hands down.

Round 2: Recovery Time Objective (RTO) — How Fast Can You Restore?

RTO is the maximum acceptable downtime before systems must be restored (NIST glossary). This is where the external drive surprises. If you have a complete full backup on an external drive, restoring is straightforward — plug in, copy back, done. For a typical user with a few hundred GB, that might take a few hours. A NAS restore, however, involves more steps: you need to access the NAS, locate the snapshot, and restore files — which can be slower if you're restoring an entire system. But NIST SP 800-34 notes that RTO must be shorter than the Maximum Tolerable Downtime (MTD), and for mission-critical systems, RTO is often under 1 hour. If your business can't survive more than an hour of downtime, neither an external drive nor a basic NAS will cut it — you'd need a more robust solution. For most home and small office users, RTO of a few hours is acceptable. In this round, it's a tie, but the NAS has an edge if you have a good restore procedure in place. I've seen NAS restores that were faster than external drives because the NAS had a local copy of the backup, but that's not a given. The real differentiator is testing — more on that later.

Round 3: Ransomware Resilience — The New Battlefield

Ransomware is the reason you need a backup in the first place. CISA's updated #StopRansomware Guide, published May 23, 2023, emphasizes the importance of maintaining offline, encrypted backups and regularly testing them (CISA news). NIST SP 800-209 warns that attackers target backups, and ransomware has evolved to include storage components like NAS and backup appliances. This is where the external drive shines — if it's unplugged, it's effectively air-gapped. An external drive that's physically disconnected from your computer is immune to ransomware that encrypts your primary storage. A NAS, on the other hand, is always connected, and if it's mapped as a network drive, ransomware can encrypt the snapshots too. However, modern NAS units offer immutable snapshots — you can lock snapshots so they can't be altered or deleted, even by an admin. NIST SP 800-209 defines immutability as the ability to lock data after creation, preventing alteration or deletion. If your NAS supports immutable snapshots, it can be as ransomware-resistant as an offline drive, as long as you configure it correctly. But the external drive has a simplicity advantage: it's offline by default. For the average user, I'd say the external drive wins on ransomware resilience, but only because they're more likely to unplug it. If you have a NAS with immutable snapshots, you get the best of both worlds — but it requires configuration and discipline.

Round 4: Cost and Practicality — The Real Decider

Let's talk money. An external drive costs, say, $60 for 2TB. A NAS with two bays and two 4TB drives (for RAID) costs $300–$500, plus setup time. That's a big difference. But what's your time worth? The 3-2-1 rule, coined by photographer Peter Krogh, calls for 3 copies of data, on 2 different storage media, with 1 copy off-site (CISA). Note that it says '2 different storage media' — an external drive and a NAS are both local, but they're different media types (USB vs. network). To satisfy the rule, you still need an off-site copy. So if you're on a tight budget, an external drive is a reasonable start, but it's only one copy. A NAS gives you more flexibility for snapshots and replication, but you're paying for that. My specific example: I have a client who runs a small photography business. They have 2TB of raw files. They used an external drive for backups, but their RPO was a week because they only backed up on Sundays. After a ransomware attack (they were lucky to have a backup), they switched to a NAS with hourly snapshots and a cloud backup for off-site. The NAS cost them $400, but it saved them from losing a day of work. The external drive is still there, but now it's used for the 3-2-1 off-site copy (they take it to a safe deposit box weekly). That's the key: the NAS became the primary local backup, but the external drive is still part of the strategy.

Who Should Buy Which?

If you're a casual user with a few GB of documents and photos, and your RPO can be a week, an external drive is fine. Just remember to plug it in regularly. But if you're a professional, a small business, or anyone who can't afford to lose more than a day of work, get a NAS with snapshot and immutability features. The cost is justified by the reduced RPO and the ransomware protection. However, don't forget the 3-2-1-1-0 rule — a modernized version that adds 1 immutable or air-gapped copy and 0 unverified backups (CISA). That means even with a NAS, you need an off-site copy, and you must test your restores. CISA advises regular testing, and NIST SP 800-209 recommends testing at least monthly for critical data. I've seen too many people assume their NAS is backing up when it's not — the only way to know is to do a test restore.

Comparison Table

The Bottom Line

The single most important thing to remember: a backup you haven't tested is just a hope. Whether you choose an external drive or a NAS, you must regularly test your restores (NIST SP 800-209). The best local backup is the one that meets your RPO and RTO, and for most people, that means a NAS with snapshots — but only if you configure it properly and verify it works. Don't let the cost scare you; consider the cost of losing your data.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• CISA news - https://www.cisa.gov/news-events/news/cisa-fbi-nsa-ms-isac-publish-updated-stopransomware-guide