Cloud Backup vs Local NAS: Which Strategy Protects Family Photos When It Matters

Every few months, someone posts on r/datahoarder or r/homelab after losing years of photos. Sometimes it’s a failed hard drive. Sometimes it’s a ransomware attack that encrypted everything, including the NAS they thought was protecting them. Sometimes it’s a Google account suspension with no warning and no appeal path. The thread fills up fast with “I’m so sorry” replies and a dozen people quietly going home to check their own backups.

The debate framed as “cloud vs NAS” misses the point entirely. Both strategies have specific, well-documented failure modes. The goal isn’t to pick a winner. The goal is to understand where each one breaks down and build a setup that covers those gaps.

The Real Risk Profile for Family Photo Storage

Before picking any hardware or service, it helps to map out what you’re actually defending against.

Accidental deletion is the most common threat by a wide margin. Someone clears a camera roll thinking it uploaded. A folder gets moved and nobody notices for three months. Local NAS with versioning handles this well. Most cloud services handle it adequately, but recovery windows vary. Google Photos gives you 60 days in the trash. Backblaze B2 keeps deleted file versions based on your retention settings.

Hardware failure hits NAS users who skip RAID or who treat RAID as a backup (it isn’t). A single-drive NAS with no redundancy is just a hard drive with a network port. RAID 1 or RAID 5 protects against drive failure but does nothing for the other threats on this list.

Ransomware is the threat that breaks people’s faith in local backup. Modern ransomware variants actively scan networks for attached storage and NAS devices. Synology itself published advisories in 2021 and 2022 about ransomware campaigns specifically targeting DiskStation devices exposed to the internet. A NAS that’s network-accessible and not properly isolated can get encrypted right alongside the computers it was supposed to protect.

House fire, flood, or theft eliminates everything local in one event. A NAS in the same building as your computers doesn’t count as offsite backup. It counts as a second copy in the same blast radius.

Account compromise and ISP downtime are cloud-specific failures. A hijacked Google or iCloud account can mean losing access to every photo stored there. ISP outages don’t destroy data, but they can make cloud-only setups completely inaccessible for hours or days, which matters when you need a photo for something immediate.

Where Cloud-Only Breaks Down

Cloud storage is genuinely excellent at being offsite, always-on, and accessible from any device. It’s also quietly building several failure points that don’t show up until you need recovery most.

Account lockout is underreported because people who get locked out often lose their ability to document it publicly. Google’s automated systems flag accounts for policy violations, and the appeals process is slow and inconsistent. Storing irreplaceable photos in a single Google Photos account with no backup copy is a single point of failure dressed up as convenience.

Subscription cost creep compounds over time in ways that aren’t obvious upfront. Google One’s 2TB plan runs $99.99 per year as of 2025. That’s manageable year one. Over ten years, that’s roughly $1,000 before any price increases. Amazon Photos is included with Prime, but Prime itself has increased in price multiple times. Cloud pricing is not fixed, and you’re always one billing change away from a forced decision about your data.

Data center outages are rare but documented. Backblaze published transparency reports showing their historical uptime. Google and Amazon have both had regional outages affecting storage services. For most families, a few hours of unavailability is annoying but not catastrophic. For anyone who has moved entirely off local storage, it’s a reminder that “the cloud” is someone else’s hardware.

For a detailed look at what Backblaze B2 costs compared to consumer cloud services, our Synology-to-Backblaze B2 setup guide breaks down the per-GB pricing.

Where NAS-Only Breaks Down

A NAS in a home office feels like a serious backup solution, and for some threats it is. For others, it’s a false sense of security that’s more dangerous than no backup at all because it stops people from taking additional steps.

Device theft is straightforward. A burglar who takes the computers often takes the NAS too, or at minimum the drives, which are easy to grab and resell. An encrypted NAS helps with data privacy after theft but doesn’t recover your photos.

Hardware failure at scale hits differently than people expect. Drives in a NAS run continuously. Consumer drives aren’t rated for that. NAS-specific drives like the Seagate IronWolf 8TB are rated for 24/7 operation and carry a 3-year warranty with Rescue data recovery service included. The WD Red Pro 4TB similarly targets always-on NAS workloads. Using desktop drives in a NAS saves money upfront and creates a reliability problem that shows up 18 months later.

Ransomware spreading to NAS is the failure mode that surprises people most. If a NAS is mounted as a network drive on an infected Windows machine, or if QuickConnect is enabled with a weak password, ransomware can reach it. Synology’s own security bulletins recommend disabling default admin accounts, enabling two-factor authentication, and not exposing management ports directly to the internet.

Single-location risk means the NAS and all your computers can be destroyed together in a fire, flood, or severe weather event. RAID inside a NAS protects against drive failure. It does nothing against the building burning down.

Sizing your NAS correctly before any of this matters. Our NAS capacity sizing guide for family backup covers how much storage families realistically need at different photo and video volumes, and the 4TB vs 8TB drive decision breakdown helps with the cost-per-GB math.

The 3-2-1 Rule Applied to Family Media

The 3-2-1 rule exists because data loss scenarios almost always involve one failure mode at a time. Having three copies means a single failure leaves you with two. Having two different media types means a failure specific to one type doesn’t hit both. Having one offsite copy means a local disaster doesn’t end everything.

For family photos specifically, this translates to:

Copy 1: The original, on the device that captured it (phone, camera card)

Copy 2: Local NAS with RAID redundancy. This covers accidental deletion, hardware failure on the primary device, and fast local recovery. A two-bay Synology running RAID 1 with NAS-rated drives handles this tier well.

Copy 3: Offsite cloud backup, specifically an object storage service like Backblaze B2 rather than a consumer sync service. B2 charges $0.006 per GB per month for storage. One terabyte costs roughly $6 per month, or $72 per year. That’s considerably less than Google One’s 2TB plan for the same offsite protection.

The key distinction: Copy 3 should be a backup, not a sync. If ransomware encrypts Copy 2, a sync service propagates the encryption to Copy 3. A backup service with immutable or versioned storage does not.

Real Cost Comparison: 2, 5, and 10 Years

This math changes depending on how much data you have, but using 2TB as a baseline for a family’s photo and video archive:

Cloud-only (Google One 2TB at $99.99/year):

• 2 years: ~$200
• 5 years: ~$500
• 10 years: ~$1,000+

NAS + Backblaze B2:

• Two-bay Synology DS223 (street price $300) plus two NAS-rated 4TB drives ($200 total): roughly $500 upfront
• Backblaze B2 at 2TB: ~$14.40/month or ~$173/year
• 2 years: ~$846 (hardware + cloud)
• 5 years: ~$1,365
• 10 years: ~$2,230

At face value, cloud-only looks cheaper for five years. But that comparison doesn’t account for what you get with the NAS: local recovery speed, no throttling, a physical copy under your control, and the ability to store more than 2TB without jumping to a higher tier. It also doesn’t account for cloud price increases, which have happened consistently across every major provider.

For families with 4TB to 8TB of media, the math flips faster. B2’s per-GB pricing scales linearly. Google One’s 5TB plan is $249.99 per year. The NAS hardware cost doesn’t change.

Hybrid Setup: Synology Backing Up to Backblaze B2

The practical implementation of a 3-2-1 strategy for most families involves a Synology NAS using Hyper Backup to push encrypted backups to Backblaze B2. Synology has a native B2 integration. The setup is not complex, it doesn’t require a monthly subscription beyond B2’s storage costs, and the backups are encrypted before they leave your network.

Hyper Backup supports versioning, which means if ransomware hits locally, the B2 copy retains previous clean versions of your files based on your retention settings. This is the specific gap that cloud sync services don’t cover.

The full Synology-to-Backblaze B2 setup walkthrough is here, including how to configure the B2 bucket, set up application keys with limited permissions, and verify the backup job is actually completing.

Testing Recovery: What Actually Happens When You Need 500GB Back

Recovery speed is where the two strategies diverge most sharply. Restoring 500GB from a local NAS over a gigabit home network takes under an hour in most cases. Restoring 500GB from cloud backup depends entirely on your internet connection.

At 100Mbps download (common for cable and fiber plans), 500GB takes roughly 11 hours of continuous download. At 25Mbps, that’s closer to 44 hours. Backblaze offers a Fireball physical media service for large restores, but that adds cost and time.

The practical conclusion: local NAS is faster for recovery by an order of magnitude. Cloud backup is irreplaceable for disaster scenarios where local hardware is gone. Neither one alone covers both situations.

A backup you’ve never tested is a backup you can’t trust. Scheduling a quarterly test restore of at least a sample folder from both your NAS and your cloud backup confirms the jobs are running, the encryption keys work, and the recovery process is something you’ve actually done before you need it under stress.