Backup Your NAS to an External Drive in 2026: Rotation, Encryption and Control

A backup on an external drive only really protects a NAS if it meets three conditions. It must be encrypted, so a lost or stolen drive reveals nothing. It must keep multiple versions, through rotation that preserves history instead of overwriting the only copy. And it must be checked, because a backup that has never been tested is worth very little. This tutorial shows how to get there on a Synology DS224+ running DSM 7, without hacks.

“Classic Linux” methods (cryptsetup, apt-get, an rsync script run by cron) don’t fit here. DSM has no apt package manager and isn’t designed for you to encrypt a USB drive yourself with LUKS. Synology instead provides Hyper Backup, its official tool. It can back up to a USB drive attached to the NAS, encrypt client-side with AES-256, rotate versions (“Smart Recycle” rotation) and check backup integrity on a schedule. That’s the method described here, plus physical rotation across two drives. On a QNAP (for example a TS-673A), the principle is the same with the official Hybrid Backup Sync (HBS 3) app, but the menus are different: follow QNAP’s documentation in that case.

Prerequisites

A Synology NAS running DSM 7 (example: DS224+). Menu labels can vary slightly between DSM versions. Check the built-in help for your version.
An external USB drive. The Western Digital Elements Desktop 8 To fits: it’s a USB desktop drive with its own power supply. For rotation, plan for two drives with enough capacity.
The Seagate IronWolf Pro 12 To ST12000NT001 is a bare internal 3.5” SATA drive. It only becomes an external drive inside a powered 3.5” USB enclosure (with a mains adapter), bought separately. Otherwise, it really belongs in a NAS bay.
A DSM administrator account.
Optional: SSH access on the local network only, for command-line checks.
A place outside the NAS to store the encryption password and key file: a password manager, a USB stick kept separately, etc.

Step-by-step installation

Step 1: Identify the external drive (without getting it wrong)

Plug the drive into a USB port on the NAS. DSM detects and mounts it on its own: you don’t need to run any mount. In the interface, open:

Control Panel > External Devices > External Devices

Identify the drive by its model and capacity. If you’ve enabled SSH (local network only), you can also check from the command line. These commands only read:

# List disks and their size (lsblk if your DSM has it, otherwise fdisk)
lsblk -o NAME,SIZE,MODEL,TRAN 2>/dev/null || sudo fdisk -l | grep "^Disk /dev/sd"
# See where DSM mounted the USB drive
ls -d /volumeUSB*/usbshare*
df -h | grep -i volumeUSB

Check: the drive shows up with the right capacity (about 7.3 TiB displayed for an 8 TB drive), and a mount point such as /volumeUSB1/usbshare exists. A USB drive gets a name like /dev/sdX (or /dev/usbX depending on the model). It never gets a name like /dev/diskX, which is macOS notation.

Step 2: Format the drive as ext4

⚠️ Warning: formatting permanently erases everything on the selected drive. Before you click, double-check the model and capacity shown (step 1). Unplug any other USB drive so you can’t pick the wrong one.

DSM can format an external drive as ext4, FAT32 or exFAT. Choose ext4: it handles large files and Linux permissions. The drive will then only be readable by the NAS (or a Linux PC), which isn’t a problem for a Hyper Backup target.

Control Panel > External Devices > External Devices
→ select the drive > Format > File system: EXT4 > OK

Check: in the list, the drive now shows the EXT4 file system. Over SSH, check that the mounted drive is empty and writable:

df -hT | grep -i volumeUSB      # expect type ext4
ls -la /volumeUSB1/usbshare/    # empty directory (apart from system items)

Step 3: Install Hyper Backup

Hyper Backup is installed from Package Center (DSM has no apt-get):

Package Center > search "Hyper Backup" > Install

Check: the package appears under “Installed” with the status “Running”, and the app opens from the main menu.

Step 4: Create the encrypted backup task to the USB drive

In Hyper Backup, click + and follow the wizard:

+ > Data backup task
→ Destination: Local Folder & USB
→ Create backup task
→ Shared folder: usbshare1 (the external drive); Directory: NAS-Backup-A
→ Sources: tick the shared folders to protect (e.g. photo, home, documents)
→ Applications: optional

Backup Settings screen:

Task name: NAS-to-USB-A
[x] Enable backup schedule (e.g. daily at 02:00)
[x] Enable backup integrity check + schedule (e.g. weekly)
[x] Enable client-side encryption → enter a strong password
[x] Compress backup data (optional)

Client-side encryption and compression are only available in multi-version backups (.hbk format), which is this wizard’s default mode. When you enable encryption, Hyper Backup automatically downloads an encryption key file. Store it, along with the password, outside the NAS and outside the backup drive. Synology can’t recover a lost password: without it or the key, the backup is permanently unreadable. Also assume encryption can’t be added to an existing task later. You decide it when you create the task.

Check: the key file is in your PC’s download folder. Copy it into your password manager before you continue.

Step 5: Configure version rotation

Still in the wizard, on the Rotation Settings screen:

[x] Enable backup rotation
( ) From the earliest versions
(•) Smart Recycle
Number of versions: 30 (adjust to the available space)

According to Synology’s documentation, all versions are kept until the maximum number is exceeded. After that, Smart Recycle prioritises keeping the first version of each hour, each day and each week, and removes the others first. Locked versions are never removed and don’t count toward the maximum. “From the earliest versions” simply deletes the oldest one. The summary (“timeline”) at the bottom of the screen shows which versions will be kept.

Check: finish the wizard and agree to run the first backup right away. The task must end with the status “Successful”. On the drive, a .hbk folder must appear:

ls -la /volumeUSB1/usbshare/
du -sh /volumeUSB1/usbshare/NAS-Backup-A.hbk

Step 6: Set up physical rotation across two drives

With a single drive plugged in all the time, you’re still exposed to a power surge, theft or ransomware that would also hit that drive. The best practice is to alternate two drives, one of which is stored off-site.

Before unplugging drive A, eject it cleanly:

Control Panel > External Devices > select the drive > Eject

Plug in drive B and format it as ext4 (step 2, re-checking the model and capacity). Then create a second task, NAS-to-USB-B, targeting the NAS-Backup-B directory, with identical encryption and rotation (steps 4 and 5).
After that, swap the drives at a fixed interval, for example every week. The task whose drive is absent will fail and notify you. That’s expected, but make sure the other task succeeds.

Check: in Hyper Backup, each task shows a recent last successful backup, and the off-site drive is never more than one cycle behind.

Step 7: Check integrity and test a restore

The scheduled check (step 4) examines the data and the version index to detect corruption. You can also run it manually from the task, with the backup integrity check action (the exact label depends on your Hyper Backup version). This check doesn’t replace a restore test. To run one, first create a restore-test shared folder (Control Panel > Shared Folder), then restore a few files into it:

Hyper Backup > select the task > Backup Explorer
→ pick a version > select files > Copy to > /restore-test

Then compare the restored files with the originals. The command only reads:

cd /volume1/photo/2025 && sha256sum file1.jpg file2.jpg > /tmp/orig.sha256
cd /volume1/restore-test && sha256sum -c /tmp/orig.sha256

Check: sha256sum -c prints OK for every file. For troubleshooting, Hyper Backup Explorer (Windows, macOS, Ubuntu) can read an encrypted backup without the NAS, as long as you have the password or the key. An ext4 drive isn’t readable as-is on Windows or macOS: run this test from Ubuntu.

Verification checks

Hyper Backup: each task shows “Successful” and a recent last backup date.
The scheduled integrity check reports no errors (see the task log).
The .hbk folder is present on /volumeUSB1/usbshare/ and its size matches your data.
A restore test with a sha256sum check is done at least once a month.
The password and key file are accessible without the NAS.

Security and best practices

No admin interface exposed to the Internet: don’t forward the DSM ports (5000/5001) or SSH on your router. For remote access, use a VPN.
SSH: enable it only if you need it (Control Panel > Terminal & SNMP), on the local network, then disable it after your checks.
3-2-1 rule: three copies, on two types of media, one of them off-site. The off-site drive in the rotation fills that role.
Notifications: set them up (Control Panel > Notification) so you’re alerted when a backup or a check fails.
Updates: keep DSM and Hyper Backup up to date from Control Panel and Package Center.
Never keep the encryption key file on the NAS or on the backup drive.

Troubleshooting common errors

The drive doesn’t appear in External Devices: try another USB port or cable, and check that the drive is powered (a 3.5” enclosure needs a mains adapter). Also check that the USB ports aren’t disabled in the external device settings.
“File system not supported”: the drive is in a format DSM can’t mount or use for this task. After backing up its contents elsewhere, reformat it as ext4 (step 2).
The task fails after a drive swap: that’s expected for the task whose drive is absent. If the right task fails too, check that the drive is mounted under the same share name (usbshare1). If it isn’t, use the relink option for an existing task in the Hyper Backup wizard.
Encryption password rejected: try the key file. Without the password or the key, no recovery is possible.
Drive full: lower the number of versions in the task’s rotation settings, or move to a larger drive.

FAQ

Is the backup automatic?

Yes. The Hyper Backup task schedule runs it on its own, with no script or cron. Only the physical drive swap stays manual.

How do I move to a larger drive?

Format the new drive as ext4 and create a new task on it. Keep the old drive until the new task has built up enough versions. There’s no need to “resize” anything.

What frequency should I choose?

A daily backup with Smart Recycle, a weekly integrity check and a weekly drive swap is a good starting point. Adjust it to how fast your data changes.

Can another NAS be used as a target?

Yes. Hyper Backup accepts a remote Synology NAS as a destination, with the same client-side encryption. It’s a good complement to the external drive.