Full vs incremental vs differential backups.

A full backup copies everything you have chosen to protect. An incremental backup copies only what has changed since the last backup of any kind, and a differential backup copies everything that has changed since the last full one. Backup software uses one of these or a mix, and the choice affects how long each backup takes, how much storage it fills and how much work a restore is.

What each one copies

• Full: every file in the folders or systems you selected, every time. Everything sits in one set, so finding a file is simple. Each run is slow, and keeping many full copies of files that rarely change uses a lot of storage.
• Incremental: only the files created or changed since the previous backup, whatever type that backup was. Each run is quick and small.
• Differential: the files created or changed since the last full backup. A file that changes on Monday is copied again every night until the next full backup, so each run is a little bigger than the one before.

The difference shows when you restore

Say a full backup runs on Sunday night, the other nights run something smaller, and the server fails on Thursday morning.

With incrementals, a complete restore needs Sunday’s full backup and then Monday’s, Tuesday’s and Wednesday’s. With differentials it needs two pieces: Sunday’s full backup and Wednesday’s differential, which already holds everything that changed since Sunday.

That is the trade. Incrementals are faster to make and use less storage, and a restore has more pieces to put together. Differentials take longer and get bigger as the week goes on, and a restore has fewer pieces.

What cloud backup services do

The schedule most people have heard of, a full backup at the weekend and something smaller each evening, is the example NIST gives in its contingency planning guide. Not every product follows it. Microsoft’s documentation for Azure Backup says the service takes a full backup the first time and incremental backups after that, with no need to add further full backups. It does not use differentials at all.

So the method in use depends on the product. It is worth knowing which one you have, because it tells you what a restore depends on.

How to choose

In most small offices the backup product makes this choice for you. The decisions that stay with the business are the ones NIST and the Australian Signals Directorate both tell you to write down:

• How often backups run. This sets how much work you could lose. The right answer depends on how often your files change and how much they matter.
• How quickly you need the data back. A restore built from many pieces has more steps. How much downtime could your business afford? helps put a number on it.
• How long backups are kept. This decides how far back you can go when a problem is found late.
• Who does the restore, and whether they have done one before.

Then ask whoever runs your backups which method they use, and what would have to be in place to restore everything as it was last night.

Where to go next

The backup type covers what gets copied. Where the copies are kept is covered in The 3-2-1 backup rule, and checking that they work is covered in A backup you have never restored is a guess.