How to back up a small office server or NAS

Image backups versus file backups

A file backup copies documents, folders and data. It is ideal for restoring a deleted spreadsheet but slow and fiddly for rebuilding a whole server, because you first have to reinstall the operating system, applications, settings and permissions by hand. An image backup captures the entire machine, including Windows, installed software and configuration, so it can be restored to new hardware or a virtual machine in one operation.

For a server that runs anything important, such as accounting software, a line-of-business database or file shares with complex permissions, you want image backups. Most modern backup products take images and still let you pull out individual files from them, so you get both from the same job. That combination means a lost folder and a dead server are handled from one console with one set of skills.

Local copy for speed, cloud copy for disasters

A local backup to a separate device in the office, often a dedicated backup appliance or a second NAS, gives fast restores. Bringing back a large server over the local network is much quicker than downloading it from the internet. Some appliances can even start a failed server as a virtual machine while you sort out replacement hardware, cutting downtime to minutes or hours.

The local copy is useless if the office burns down or the equipment is stolen, so every server and NAS also needs an offsite copy in the cloud. Ideally that cloud copy is immutable, locked against deletion for a set period, so ransomware that reaches the local backup still cannot destroy the offsite one.

NAS boxes need special care

Network attached storage devices are popular in small offices because they are affordable and easy. They are also frequently the only copy of years of work. RAID, the feature that lets a NAS survive a disk failure, is often mistaken for a backup. It is not. RAID protects against one drive dying; it does nothing for deletion, ransomware, a failed controller, a firmware bug or theft of the whole box.

NAS devices exposed to the internet for remote access have also been hit by ransomware campaigns aimed specifically at them. Keep firmware updated, avoid opening the NAS directly to the internet, use a VPN for remote access, and back the NAS up to a separate cloud service with its own credentials. Built-in snapshot features are useful but live on the same box, so treat them as a convenience rather than protection.

Databases and applications

Accounting packages, practice management systems and other databases are constantly writing. A simple file copy taken mid-write can produce a backup that will not open. Good backup software uses application-aware methods, such as the Windows Volume Shadow Copy Service, to pause writes briefly and capture a consistent state. Some applications also have their own export or backup function that produces a clean file to include in the main backup.

Check with your software vendor how they recommend backing up their data, and confirm your backup includes the actual data location, which is not always where you expect. During setup, restore a copy of the database to a test machine and open it in the application. That single check catches most problems.

Common gaps we look for

The usual weak points are predictable: a backup job set up years ago that no longer includes a newly added drive; a NAS backing up to a USB disk permanently plugged into itself; cloud backups paused because a subscription lapsed; an encryption password that only one former employee knew; and a backup appliance using the same admin account as the server, so one stolen password reaches everything.

Ageing hardware is another risk. A server or NAS past five or six years old is more likely to fail, and its disks may all be from the same batch, so when one fails others may follow during the rebuild. That is a strong reason to have backups verified before replacing a disk or attempting a migration.

Should the server stay at all?

When a server reaches replacement age, it is worth asking whether its job could move to the cloud. File shares often fit well in SharePoint or Google shared drives, and many accounting and practice systems now have cloud versions. Moving reduces what needs backing up on site, although cloud data still needs its own independent backup.

Some workloads genuinely suit a local server, such as large design files on slow internet or software that has no cloud version. In that case, invest in good image backups, a local appliance and an offsite copy, and test the full restore at least once a year. Document how the server was built, including licence keys and vendor contacts, and store that alongside the backup details.