Your expert in backup and data protection!The solution tailored to your needs
How do you back up a NAS?
A NAS is a place where files live, not a backup. You back it up by copying its shares and its configuration to another system, outside the NAS, with several restore points. Otherwise, a disk failure, theft or the encryption of the share takes out the only copy.
Key points
- RAID lets you keep working when a disk dies; it also replicates deletions and encryption.
- Local snapshots are a good first layer, but they disappear with the NAS.
- Copy the shares and the configuration (users, permissions, shares, tasks).
- The CNIL, France’s data protection authority, recommends a backup at a geographically separate site and at least one isolated offline copy.
- Restore a folder from the external copy every quarter, not from the local snapshot.
Why the NAS’s RAID is not enough
RAID (or SHR on Synology, and the equivalent on QNAP) lets you keep working when a disk dies. It also faithfully replicates a deletion, a format and ransomware that encrypts the files on the share. The NAS recycle bin and local snapshots help against a recent mistake. They are lost with the NAS in a fire, and they are often accessible to the same administrator account that the attacker uses.
The ANSSI, France’s national cybersecurity agency, makes this point in its ransomware guide: backups must cover all data, including that of file servers, and at least the most critical ones must be disconnected from the information system. A NAS plays exactly this file server role.
Local snapshots remain a good, short-term first layer for restoring a file within the day. They do not replace the external copy.
| Protection | Disk failure | Accidental deletion | Ransomware | Fire, theft |
|---|---|---|---|---|
| RAID / SHR | Yes | No | No | No |
| Recycle bin, local snapshots | No | Yes, short term | Sometimes | No |
| Second NAS on site | Yes | Yes, if versioned | Rarely | No |
| Encrypted external copy with version history | Yes | Yes | Yes, if isolated or immutable | Yes |
What to copy
- The shares containing working documents, profiles, scans and active archives.
- The folders of NAS applications (backups it already receives from other computers, photos, repositories) if this data exists nowhere else.
- The NAS configuration: users, permissions, shares, tasks. Rebuilding the permissions of forty users from memory takes longer than copying the files back.
- Databases or virtual machines hosted on the NAS, using a consistent method, not just the disk file copied while running (see What backup do you need for a virtual machine?).
There is no need to back up the NAS operating system like a Windows server image: if it fails, you replace the device and reapply the configuration plus the data. Unless you have identical hardware and a tested procedure, the manufacturer’s image is rarely the safest route.
How the copy should be made
The CNIL sums up the basic rules: store at least one backup at a geographically separate site, isolate at least one backup offline, and protect backups to the same level as the original data. Applied to a NAS:
- To another site, or to an outsourced service, encrypted before it leaves the network.
- With several restore points, not a synchronisation that immediately propagates encryption.
- With a backup account that is not allowed to erase the remote history.
- An immutable copy if the documents on the NAS are the company’s memory.
- An alert if the overnight job has not run. NAS devices send emails that nobody reads any more: the alert must reach a named person.
Synology (Hyper Backup, Snapshot Replication) and QNAP (Hybrid Backup Sync) can send a copy to another NAS or to a cloud. The feature exists. It is often not enabled, or it points to a second share on the same device.
For a copy on a USB disk, good practice is to disconnect the media after each backup and keep it in a different location: a disk permanently connected to the NAS will be encrypted along with it.
Minimum test
Every quarter, restore a recent folder from the external copy, not from the local snapshot. Once a year, check that the configuration (a user, a share) can be rebuilt. The CNIL lists never checking that backups are usable among the mistakes to avoid.
At WeDoBack
NAS devices are among the systems backed up, alongside servers and workstations; the page dedicated to health data mentions Synology and QNAP NAS devices. Data is encrypted before it is sent, with a key held by the customer, then stored on servers dedicated to backup, separate from the NAS and replicated in several European countries, or in the zone required by law. The NAS is a source to include in the subscribed volume, with SMART at 49.99 € excl. VAT per TB per month or with INTEGRAL depending on the tier. For sizing, WeDoBack publishes a rule of thumb: current volume multiplied by three, then adjusted after a week of use. The IMMUTABLE offer can be added for documents that must be protected from any deletion.
Frequently asked questions
My NAS uses RAID 1. Is that a backup?
No. RAID 1 writes the same data to two disks at the same time: if a file is deleted or encrypted, it is deleted or encrypted on both. It protects against a disk failure, not against human error, theft, fire or ransomware.
Is a second NAS in the same office enough?
It is better than nothing against a failure of the first one, but insufficient against fire, theft or ransomware using the same administrator account on both devices. The CNIL, France’s data protection authority, advises against keeping backups in the same place as the machines that host the data.
Should the NAS operating system be backed up?
Rarely as an image. If it fails, you replace the device, reapply the exported configuration, then restore the data. However, keep the configuration export up to date and stored outside the NAS.
Further reading
Sources
Documents consulted in October 2026.
- Security: Backing up — CNIL (French authority)
- Cybersecurity guide for SMEs – 12 steps to securing your business (June 2021) — ENISA, the European Union Agency for Cybersecurity
- Ransomware attacks, everyone is concerned – How to anticipate them and respond to an incident (ANSSI-GP-077, August 2020) — ANSSI (French agency)
- Backing up information systems – The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025) — ANSSI (French agency)
- Offers and prices — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.