Full, incremental, and differential: three confusing terms when it comes to traditional backups.
In this article, I’m going to describe how each one works so we can compare them and see which is most appropriate for you.
Become a Patron of Ask Leo! and go ad-free!
Backing up your computer
The files on your computer, along with a little overhead information, represent everything stored on it.
This includes your data, the programs you run, the operating system, settings, temporary information, and much more.
It’s these files — your data, your programs, your everything else — you can lose in an instant should you encounter a sudden hardware failure, malware, or other unexpected event.
Regardless of which approach you take, backing up, at its core, is nothing more than making copies of those files and putting those copies somewhere else in a way they can be recovered should your originals be lost.
We’ll start with the simplest: the full backup.
When we perform a full backup, we back up everything. A full backup includes Windows, your programs, your settings, your data files… everything.
That’s why I love it — because there’s no question about what is being backed up.
Let’s say we take a full backup on Sunday night.
On Monday, you take some pictures and upload them, you update your resume, and you work with a spreadsheet. On Monday night, we do another full backup, so in this backup, we have Windows, all of our programs, and all of our files, including the new photo files and the changes you made to your resume and spreadsheet.
The result? A full backup image that completely represents the entire machine as it is on Monday night.
You can keep Sunday’s backup if you like; it’s a representation of the machine as it was on Sunday night.
How many previous backups you keep is up to you. I recommend keeping at least two, so if something goes wrong while the next is being created, you still have the current one.
Now Tuesday comes along. Maybe you work on your resume some more, and edit some of those photos you uploaded on Monday, and you start work on your friend’s resume. We’re doing nightly backups, so sure enough, Tuesday night we take another full backup: Windows, all the programs, and all your files, including the work you did on Tuesday, plus everything that changed on Monday, plus everything that was already there on Sunday.
- On Sunday, we have a full backup of the machine as it was on Sunday.
- On Monday, we have a full backup of the machine as it was on Monday.
- On Tuesday, we have a full backup of the machine as it was on Tuesday.
Each is complete; each has everything; each is independent of the others.
As you can imagine, the size of these backup files is proportionate to the amount of the data on your disk. They can get large, which means keeping a lot of them requires a lot of space.
Incremental backups are so called because they work in increments (“an increase or addition”, though here it also means “any change”).
Let’s repeat our scenario, this time doing incremental backups.
Sunday night: the very first backup that happens is a backup of everything. In other words, it really is a full backup.
Monday night: since we’re doing an incremental backup, we’re going to back up only those things that have changed since the previous backup. (Remember, on Monday you worked on your resume, a spreadsheet, and uploaded some pictures.)
Our Monday incremental backup will not stand alone. In order to have a copy of the entire machine as it existed on Monday night, we need the machine as it is existed on Sunday night, plus anything that changed Monday.
So, the first back up we did — a full backup — represents the machine on Sunday. The full backup plus that first incremental backup together represent the machine as it was when we performed Monday night’s backup. If your hard drive fails, you’re going to need both backup files to put things right.
Now Tuesday rolls around. On Tuesday, we back up only those things that have changed incrementally since Monday, because we already have everything that changed on Monday in Monday night’s backup. What we’re missing are the things that changed on Tuesday, so that’s all we have to back up.
Now, to get a representation of the machine on Tuesday night, we need:
- The backup we started with (the full backup on Sunday night).
- Plus any changes that were made on Monday (Monday’s incremental backup).
- Plus any changes that were made on Tuesday (Tuesday’s incremental backup).
These incremental backups do not stand alone. They each rely on the preceding backups in order to build an image of the machine as it was at the time the backup was taken. Every time we do an incremental backup after this, we’re only adding things that have changed since the one the night before.
Tuesday night’s backup only backs up what changed during the day on Tuesday.
Monday night’s backup only backs up what changed during the day on Monday.
Sunday night was the start of the sequence. We backed up everything — and that’s how you reset an incremental backup sequence.
In practice, you don’t simply keep taking incremental backups forever. Since each backup relies on the previous ones, if something happens to any of the previous backups, the chain is broken, and none of the following incrementals can be used. So every so often, we start over again with a full backup.
I choose to do that once a month. I keep a month’s work of incremental backups, and take a brand new full-system image backup at the end of the month, starting the sequence over. At the end of the month, I have a single full backup and 30 incremental backups. Since I have a new full backup, I can discard those 30 incremental ones (or archive them, if I so desire).
That’s what I recommend most folks should do: a monthly full backup with daily incrementals. You can restore your machine to any day along the way, as long as you have all of the intervening incremental backups. It takes a lot less space than 30 full backups for a month, and since most of what’s on your machine doesn’t change that often (like the operating system itself and the programs), you don’t really need a full backup every day.
It’s important you understand incremental backups, because they’re what I believe most people should use.
If adding differential backups to the mix seems too confusing or overwhelming, don’t fret; it’s probable you will never need to use them. But there are cases where it comes up, including in the options offered by backup programs.
The key to understanding differential backups is that each backup is the difference from the starting point.
Back to Sunday night: again, we begin with a full backup, an image of everything on your machine as it was on Sunday night.
Monday night, we back up those things that changed Monday.
That sounds a lot like the first incremental, right? So far, not dissimilar:
- Sunday’s night’s backup has everything.
- Monday night’s backup has everything that changed since Sunday: resume, spreadsheet, photos.
Tuesday is where it gets weird. Tuesday, you changed your resume, edited those photos, and started your friend’s resume.
Tuesday night’s differential backup = Monday’s changes + Tuesday’s changes.
Differential backups record the differences between the machine as it is today and the machine as it was when we started — everything that changed since Sunday’s full-image backup.
It’s not incremental. Tuesday’s backup does not know about, does not care about, and does not rely on Monday’s backup. Tuesday’s backup ignores Monday’s and builds only on the first, full Sunday backup. If we were to continue this, Wednesday’s backup would ignore Tuesday and Monday’s backup, and back up all the differences that happened since the backup sequence began on Sunday.
The big takeaway here is that each differential backup requires only the initial full backup to be complete, whereas an incremental backup requires every increment between it and the full backup that started it.
Now, the practical reality of this is that each differential backup gets larger and larger, because things change more and more. As the days go on, they get progressively bigger. At the end of the month, the differential backup includes everything that changed all month long.
Full backup is easy. Everything, every time, no questions.
Incremental: everything that changed since the previous backup.
Differential backup: everything that changed since that first, full backup.
One way to remember:
- Incremental is literally the smaller increments of change. Each day, there are incremental changes to your machine, and that’s what gets backed up.
- Differential is everything that’s different from the first backup. You have a single reference point—the first full backup—and every day you back up everything that’s different from it.
Normally, I’d simply list this article in the “related” section below, but experience has shown that these can be confusing concepts. I’d recommend you consider also reading the article “What’s an Incremental Backup?”, which presents much of this information with a slightly different approach. I hope that between the two, the concepts come across clearly.
If you found this article helpful you'll love Confident Computing! My weekly email newsletter is full of articles that help you solve problems, stay safe, and increase your confidence with technology.
Subscribe now, and I'll see you there soon,