An independent encrypted backup and recovery path

Encryption and backup solve different problems

Encryption is primarily a confidentiality control: it helps prevent a cloud copy from becoming readable without the required keys. Backup is an availability control: it gives you another path when a device, account or storage copy is unavailable or deleted.

One encrypted Google Drive copy is therefore not a complete disaster-recovery plan. A provider, an account owner, an application or a device can still remove or lose an object.

The Windows Cold Backup workflow

Cold Backup creates a verified encrypted control package that can be opened read-only and offline. Before committing the package, the workflow checks Drive reachability, current synchronization state, pending data work, key material, the encrypted database snapshot, object inventory and package integrity.

The package is written atomically only after verification succeeds. A partial working file is not renamed into the final backup as if it were complete.

What a complete independent path requires

For important data, the intended recovery set includes:

• the verified Cold Backup control package;
• a separately stored and verified Root Key copy;
• the required encrypted Nursova/ object mirror on storage you control; and
• the passwords or recovery material for any protected spaces, according to their separate rules.

Large attachments can remain separate encrypted objects. The small control package alone should not be assumed to contain every video, document or other large file.

Read-only inspection

A Cold Backup can be opened for inspection without synchronizing, using the network or modifying the source package. This makes it possible to test that the package opens and that expected Entries are present without converting the backup into a new working library.

Verification should be repeated periodically. A backup that was never opened may be incomplete, stored on a failing device or missing the key material needed to use it.

Storage separation matters

Keeping the package, Root Key and encrypted object mirror in the same folder on the same physical drive does not protect against loss of that drive. Separate copies should reflect the failures you are trying to survive: device loss, account lockout, accidental deletion, ransomware or physical damage.

Do not place a plaintext password or unencrypted private note inside the same backup folder merely to make recovery feel convenient.

Before relying on recovery

Document where each component is kept, who is allowed to access it and how often it is tested. The private workspace backup plan provides a practical checklist without asking you to publish or disclose secret values.