What's an Incremental Backup?
Hi everyone?
Leo Notenboom here for askleo.Com with one of the probably most common
questions about backing up, aside how do I back up, that I get asked and have
been asked over and over again over the years.
So today what I want to do is I want to walk through just exactly what
an incremental backup means, why you want it and when you might use it.
Let's start with the question.
I have a mental block on backing up, which unnerves my approach to it.
I have managed one full backup, 32 gigabytes, on an external hard drive.
I've just read your article
on maintenance, but do not understand what is meant by incremental backup.
Does it simply update or overwrite the existing backup or does it create
something else that only contains whatever is new since the previous backup?
I think the latter is what I prefer. To be clear.
What you prefer is indeed exactly what it is,
but it's worth going through the details specifically so that we really do
understand exactly what an incremental backup is.
Now, an incremental backup starts with a full backup.
In other words, if you have no backup at all, you have no starting point.
The very first thing that happens is a full backup.
My preference, as usual, is a full image backup,
but an incremental and full is more of a concept that could be applied
regardless how much data you're actually backing up.
So a full backup is a backup of everything
for whatever definition of everything you're using.
Since I tend to talk about image backups
all the time, it's a complete image of absolutely everything on your hard disk.
As you might imagine, that could be kind of big,
depending on how much you've got stored on your hard disk.
But that's where we start.
An incremental backup
is a backup of only those things that have changed since the previous backup.
So if you start with a full backup
and the next day you take an incremental backup, that incremental backup will
contain only those things that have changed in that day.
The reason this is valuable is that, to be honest, most of the things on your
system, on your hard drive, they just don't change that often.
Yeah, there's a lot of files that do, so don't
get me wrong, Windows is constantly touching a lot of different things,
but the vast majority are actually left untouched.
Think about it.
Windows itself, the program you have installed, that is the operating system.
Well, it doesn't change unless there's been an update.
Same for your applications.
Same for actually a lot of the data files
that you may not always be working on every day.
All of those files don't change.
So there's not a lot of value of creating
an additional copy of those files every day.
That's the theory behind it.
Incremental backup of full backup is everything.
So it'll be big.
An incremental backup are only those
things that have changed, so it'll be significantly smaller.
Now, there's another kind of backup that I
don't talk about very often, but it's also useful to understand,
and that's what's called a differential backup.
A differential backup is kind of like
an incremental backup, except it uses a different starting point.
By that, I mean, when you make a incremental backup,
it's always comparing against the previous backup.
A differential backup always compares against the first backup.
Doesn't matter what happened yesterday.
If yesterday wasn't the first backup, the next differential backup is going
to contain everything that changed since that first full backup.
Let's walk through this comparison
of exactly what those different backups look like and what they would contain.
So on day one, when we back up, a full backup is going to contain
the entire drive, as we expected on day one. Incremental backup.
Well, it's our first backup, so it's also going to contain the entire drive.
Same thing for a differential backup.
They all three start exactly the same way.
The first backup is always a backup of everything.
On day two.
Well, a full backup is always a backup of everything.
So that doesn't change.
However, an incremental backup will backup only those things that have
changed since the previous day, since day one.
Same thing for differential backup at this
point, because the only thing it has to compare against is, in fact,
those things that were backed up on day one, the full backup.
So a differential backup on that second
day is going to look exactly like an incremental backup.
Day three is where things start to get interesting.
Again, a full backup, always a backup of the entire drive.
An incremental backup would contain only
those things that have changed since the previous day.
In other words, only those things that have changed since day two.
A differential backup will contain
everything that changed since that first full back.
Doesn't matter what happened on day two. Day three's differential backup will
contain everything that changed since the full backup on day four.
Same thing.
The entire drive will get backed up for a full backup because a full backup is
always the whole thing. An incremental back up will back up,
only those things that have changed in the last day.
In other words, since day three. And the differential backup, same thing,
they're all changes since day one are backed up.
It doesn't matter that there were previous differential backups.
As long as there's a starting point,
that's what a differential backup is going to include.
So hopefully you get the idea.
Each backup contains different contents, depending on the kind of backup you have.
A full backup contains everything.
An incremental contains the increment of change since the previous day,
and a differential backup contains the difference of change since the first day.
Now, things also get interesting when we
start looking at what it means to restore each one of these.
Let's say you wanted to restore to the backup that was taken on the first day.
That's exactly the same.
Again, across all three.You would restore the full backup image that was taken on that day.
Now, let's say you wanted to restore your machine to the state
it was in on day two of that backup we did above.
Well, for full backups, you just pick the full backup
from that day and restore it. For incremental backups
you need both the full backup you started
with and the incremental backup that you took on that second day.
For differential backups,
same thing as incremental.
Once again, you need the full backup you
started with, plus the differential backup that was taken on day two.
Now, if you wanted to restore to the state your
machine was in on the day that backup number three was taken,
this is where it gets different.
The full backup for day three is what you
restore if you're taking full backups every day.
If you were taking incremental backups,
then you would need the full backup from day one to start with, the incremental
backup from day two to pick up day two's changes and the incremental backup
from day three to pick up day three changes. For differential backup,
you would need the full backup you started with and only the differential backup
from day three because it included all of the changes since the first.
Hopefully you can see now as you move
further into the backup sequence with a full backup.
You only need the backup for the day in question for an incremental backup.
You need the starting backup and all of the incremental backups taken up
until the day you want to restore to. For a differential backup.
You need only the first full backup
and the differential backup taken on the day you want to restore to.
Needless to say, differential backups are a little bit bigger than incremental
backups, but they're typically not as big as full backups.
That's why they exist.
But I generally don't recommend using them because it's not really worth it.
Here's what I do recommend.
Periodic full backups. Every so often,
take a full backup of your machine.
I recommend once a month. Once a month, start the process over.
Take a full backup of your machine, then take daily incremental backups.
That means, at most,
to restore to the most recent machine image that you took, say, yesterday,
all you would need are the full backup you started with, plus somewhere between one
and thirty incremental backup images taken in the intervening days.
With that, you would be able to restore to any one of those thirty days.
That's what you need.
That's what's safe.
Now, I generally also keep the previous month's collection.
So at any point in time I will have the previous month's starting back up,
all of the incremental backups that were taken during that month,
and then the full backup that were starting the current month,
plus however many incrementals that would get me to today.
That allows me a nice big window to be able to restore to anywhere in the last,
at least in the last month, and often even sometimes a little bit further.
What I really like is the fact that we've got snapshots going on every day.
It's not uncommon for us to not realize.
That a file was deleted or that a file is missing days or sometimes weeks after
the accident happened. By having daily backups,
going back at least a month and sometimes further, you know that you'll be able
to go back and get those deleted files within that time period.
Now, I realize that this is an incredibly
complicated topic and it's not something that comes easy to a lot of folks.
This is one way of looking at it. We've talked about it.
I've shown you in some tables.
I've walked through what happens when you
back up and when you restore using these different techniques.
I actually have a second article.
What backup do I want
Full Incremental or Differential? That discusses essentially the same topic,
but uses a slightly different model and slightly different visuals that I
would recommend you have a look at to make sure you really understand the topic.
I hope that was helpful.
As always, if you've got questions,
leave comments on this video or on the article on which this video is based.
You'll find that out at askleo.com/17586.
I'm Leo N.otenboom
This is askleo.com. Thanks for watching.