Duplicati 2.4 for Windows: Cross-Platform Backups, Disk Imaging and Ransomware Protection

In a recent workflow profile for XDA Developers, writer Parth Shah highlighted how he solved that cross-platform dilemma by installing Duplicati, a free, open-source backup utility that runs across Windows, macOS, and Linux. While Shah's hands-on perspective focuses on automating day-to-day folder backups to cloud providers like OneDrive and external drives like a Samsung T7 Shield SSD, looking closely at Duplicati's official documentation and its September 2026 Duplicati 2.4 Stable release reveals an even deeper story—along with a few critical operational rules every Windows user needs to know before trusting their data to an automated schedule.

Beyond Simple File Copying: How Duplicati Works​

At its core, Duplicati is built around encrypted, deduplicated, and compressed backup jobs controlled through a local browser-based interface. Because the interface runs in your web browser via a local background service or tray application, the layout and workflow remain identical whether you are configuring a job on Windows 11, macOS, or a headless Linux machine.

In his XDA Developers piece, Shah frames Duplicati primarily as a file-level backup utility meant for documents, photos, and active project folders rather than a full-system tool. Historically, that has been Duplicati's bread and butter: you select specific source directories, and Duplicati packages, compresses, and encrypts the contents into remote volumes (dblock, dindex, and dlist files) at your chosen destination.

However, the project's scope expanded significantly on September 4, 2026, when the Duplicati team announced Duplicati 2.4 Stable (superseding version 2.3.0.4 and consolidating the 2.3.1.x beta branch). According to Duplicati's official 2.4 release notes, the software now includes:

• Cross-Platform Full-Disk Imaging: Expanding beyond Windows to macOS and Linux, allowing raw disk and partition-level backups and restores—including partition tables—when run with administrative privileges.
• Sync Copy Mode: A dedicated, lightweight one-way file replication mode that copies files directly from source to destination without encryption, compression, or deduplication overhead, complete with support for filesystem snapshots and multiple targets.
• PAR2 Bit-Rot Protection: Optional parity generation (--parity-module=par2 when par2 is installed on the host) that uploads repair files alongside backup volumes to defend against silent storage corruption.
• Windows-Specific Polish: The Windows installer now includes integrated checkboxes to auto-configure a delayed-start Windows Service and generate HTTPS TLS certificates during installation, alongside support for backing up Windows Alternate Data Streams (--enable-ads-backup) and native desktop toast notifications.

(Note for builders grabbing the installer: check the version number on the official download portal carefully, as project pages have occasionally shown version display discrepancies between 2.3.0.4 and 2.4.0.0 alongside newer Canary test builds.)

Storage Freedom—And the Golden Folder Rule​

One of the strongest arguments for open-source tools like Duplicati—or alternatives in the space such as Kopia and FreeFileSync —is escaping cloud vendor lock-in. Commercial backup suites frequently steer users toward their own paid cloud vaults. Duplicati, by contrast, separates the backup engine from the storage backend.

According to Duplicati's official destination documentation, the software supports standard protocols and local paths—including local drives, USB SSDs, Windows SMB/CIFS network shares, FTP, SFTP (SSH), WebDAV, Rclone, and S3-compatible object storage—as well as provider-specific integrations for OneDrive, Google Drive, Dropbox, SharePoint (via the Microsoft Graph API), Backblaze B2, Amazon S3, Azure Blob Storage, Google Cloud Storage, pCloud, Box, and IDrive e2.

This allows a hybrid strategy on a single PC. As Shah notes in his setup, you can route lightweight daily documents and writing projects to Microsoft OneDrive while directing massive media folders to a local external SSD or a home NAS.

Before you start pointing multiple jobs at your cloud drive or NAS, however, Duplicati's documentation enforces one non-negotiable rule: every backup job must have its own dedicated destination folder. You must never point two different backup jobs—say, one from your Windows desktop and one from your MacBook—into the exact same destination directory. If two jobs share a folder, their index and block files will collide and corrupt both backups.

(Also note for longtime Microsoft 365 users: Duplicati's documentation marks the legacy od4b:// OneDrive for Business and mssp:// legacy SharePoint backends as deprecated in favor of the unified OneDrive and Microsoft Graph API SharePoint implementations.)

Setting Up a Reliable Windows Backup: The 5-Step Workflow​

While Shah praises Duplicati's redesigned, modernized web interface for making scheduling and folder selection approachable without touching the command line, a backup is only as strong as its configuration. Beginning with the 2.4-era interface workflow documented by the Duplicati project, setting up a job follows five distinct stages:

1. Basic Configuration & Passphrase: You assign the job a descriptive name and choose an encryption method and passphrase. Crucial warning: Duplicati is a zero-trust encryption tool. Its documentation explicitly warns that if you lose your encryption passphrase, it is impossible to recover your data. Store that passphrase in a dedicated password manager immediately.
2. Source Data Selection: Using the visual folder picker, you select which directories to protect. Selecting a folder includes all of its subfolders by default, though you can manually uncheck noisy subdirectories or define exclusion filters to skip temporary cache files and browser downloads.
3. Storage Destination: You configure the connection details for your cloud provider, NAS, or external drive and click the Test destination button to verify connectivity before proceeding.
4. Schedule: You configure the built-in scheduler to run jobs automatically (for example, daily for active work folders and weekly for archival directories). If you prefer manual or scripted triggers, you can disable the scheduler and trigger runs via the UI Start button or the ServerUtil command-line utility.
5. Retention and Volume Sizing: Because incremental backups continuously add changed data blocks over time, your storage usage will grow indefinitely unless you set a retention policy. Duplicati includes a Smart backup retention option that automatically thins out older snapshots—keeping one daily backup recently, and progressively fewer versions further back in time. You can also tune the remote volume size here (smaller volumes suit slower cloud connections; larger volumes speed up local LAN or SSD backups).

During your very first backup run, expect the progress bar to take its time. As Duplicati's documentation notes, the initial backup must scan, chunk, compress, and encrypt every single file in your source selection. Subsequent runs act incrementally, scanning for modified or newly created data and uploading only the changed blocks, which drastically reduces bandwidth and execution time.

The "Set It and Forget It" Trap—And How to Harden Against Ransomware​

It is tempting to configure an automated backup scheduler, watch the first job finish, and declare victory. Ask any veteran IT administrator, though, and they will tell you that an untested backup is merely wishful thinking.

Even when a tool runs quietly in the background, real-world resilience requires three extra habits:

• Verify Restores Regularly: Recovering a file in Duplicati is done by opening the web UI, navigating to the Restore section, choosing the backup version timestamp, and selecting the specific files or folders to reconstruct. Do not wait for an emergency to try this. Test restoring a few sample documents to a spare folder periodically to confirm your passphrase works and your destination volumes are intact.
• Respect the 3-2-1 Rule: Keeping a backup on a portable SSD plugged permanently into your Windows PC protects you if you accidentally overwrite a Word draft, but it will not save you if a power surge fries the machine or ransomware encrypts every mounted drive letter. Pair a local destination (SSD or NAS) with an off-site target.
• Enable Remote File Locking (WORM) Where Supported: What happens if malware compromises your PC and harvests the cloud credentials stored inside your backup client? As Duplicati's security documentation points out, an attacker with your storage credentials could wipe your off-site backups before encrypting your local drive. To counter this, Duplicati supports Object Locking (Write Once, Read Many) on compatible backends including Amazon S3, Backblaze B2, Azure Blob Storage, and Google Cloud Storage via the --remote-file-lock-duration option (such as --remote-file-lock-duration=30D), as well as a --soft-delete-prefix option added in the 2.3+ branch. When object locking is enabled in Governance or Compliance mode, not even someone holding your storage credentials can delete those remote backup volumes until the lock timer expires.

For Windows and Mac users tired of subscription fatigue and restrictive cloud ecosystems, Duplicati hits a rare sweet spot. It brings enterprise-grade mechanics—client-side encryption, block-level incremental deduplication, WORM object locking, and now full-disk imaging and sync modes in version 2.4—into a free, unified browser interface. Just remember to guard your passphrase, keep your destination folders separate, and test your restores before disaster strikes.