The size of incremental backups often surprises people.
All you do is edit one small document, and the next day your incremental backup ends up being gigabytes in size – that doesn’t make sense, right?
But it does make sense, because Windows is a very busy operating system.
Become a Patron of Ask Leo! and go ad-free!
Your data versus “the system”
We tend to think in terms of our own data: the documents we edit, the pictures we upload, or the work we do on our computer.
And, indeed, backing that data up daily is a critical part of what it means to back up at all – these are all files we don’t want to lose in case of failure, and files we expect our backup regime to take care of for us.
But it’s easy to overlook the fact that there’s a lot more going on than what you and I do.
There’s the operating system itself.
And it does a lot.
Windows changes a lot of files
Even if you do nothing with your computer for an entire day – nothing at all, it’s running but you never touch it – Windows is still hard at work.
Programs that make up the operating system itself are running. Programs that autostart when you log in are running. Updates are being checked, both by Windows and other software programs.
Your security software is running and scanning periodically, as well as checking for database updates and more.
There’s just a lot going on – and all that “going on” means that files are being changed. Files like:
- The system swap/paging file
- Temporary files
- Data files used by individual programs (like your security software)
- The Windows registry – its database of configuration and other settings
- The Event Log and other logging files
All that is in addition to whatever it is you’ve used your computer for, and often represents much more of a day-to-day change than you may have directly caused yourself.
Your programs change more than you think
Additional culprits include the software you run. They often change much more than just the files you work on, and some change files even if you didn’t actually “work on” anything at all.
If you fire up, say, a word processing program, you would expect that your document would change, of course. But in addition, that program may also cause changes in:
- Its own administrative files, which keep track of things like most recent edits, undo information, or documents recently accessed
- Temporary files used as part of doing its work
- Settings or other information may be updated in the registry
- The system swap file might be updated
Even for programs where you, yourself, don’t “change” anything, things change.
For example, if you browse the web, everything you view has been downloaded to your machine and placed in your browser’s cache. This cache then appears as a “changed” file, and would be included in the next incremental backup.
Even though you didn’t change anything, the programs you use change a lot.
Controlling backup size
With so much possibly changing every day, it’s important to realize that this is how your computer works, and you really do want to back all that up. When something goes wrong and you want to restore to a backup taken on a particular day, the changed information might well be critical to getting your system back to the state it was in when the backup was taken.
But, aside from getting a larger external disk for backups, what else can you do to manage the size of your backups?
Choices fall into two buckets: backup less data, or back up less often.
One thing I strongly recommend doing is running Windows Disk Cleanup. It will allow you to remove a number of things you may not need and that contribute to the size of your backups. Similarly, CCleaner, while overlapping some with Windows Disk Cleanup, will also clean out more things, particularly for many applications that aren’t part of Windows itself.
Many of the things that Windows Disk Cleanup and CCleaner remove may come back as you use your computer, but much of it will not. For all that doesn’t come back, your backups – particularly the initial full image – will be smaller.
While not my first choice, you can also alter how often you take incremental images. If you take them every day, you might schedule them every other day instead.
What to expect
Unfortunately, I can’t really give you hard numbers, or even percentages, of what to expect in terms of size for your own incremental backups. It varies, due not only on the backup software you use, but also exactly how you use your machine and what software is installed and running on it. One person’s incremental backup might be one tenth the size of another’s, and it could all be quite appropriate and necessary.
What I can say is that I’d much rather have you back up too much than not enough. . . and that means the easiest solution might well be that larger external hard disk I mentioned earlier.
Do this
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
I'll see you there!
When I was investigating the pros and cons of different free backup programs, I discovered that Easeus Todo Backup has a file exclusion function available in their paid version. You can specify filenames which you don’t want in your backup such as swapfile.sys, hiberfil.sys, pagefile.sys, *.tmp. You can even specify folders such as the Temp folder.
Hi Leo,
I am wondering if doing daily incremental backups puts you at risk of carrying over malware when that backup is put on the machine ?
I don’t really need incremental backups and so after my first installation on a new machine I do a full disc image and use this as Day 1 if I need to restore. I then will update and make a second image . Although not water tight I feel this helps to keep the PC free of unwanted intruders as well as avoiding the general build up of files and fragments.
Daily incrementals is probably safer because if you do pick up something nasty on Day 3, you only have to restore your system back to Day 2 — you’ve only lost 1 day of work. Whereas, if you do monthly incrementals and the malware comes in on the 30th of the month, you will have lost a whole month’s worth of work because the only safe backup you have is almost a month old.
If you do daily incremental backups, you can go back and restore from the backup taken just before the malware attack, and you should be good to go. Then, using your backup program, you can mount the latest incremental backup as a virtual disk and copy over all of your personal files added since the backup you restored from. That’s the beauty of daily incremental backups. They really are a silver bullet. As James said, you can lose up to a month’s work if you only back up monthly.
I always receive your important experienced letter.
I have been subscribed with you for several years and I have always found your instructions very helpful
I have now download Macrium Reflect Back up.
I think I shall use it to make an image of my PC – please inform me whether it is better to us incremental or differential.
Thanks
That’s covered by this article already on the site: https://askleo.com/is-it-better-to-use-incremental-or-differential-backups/
I would like to point out that another thing that may severely blow up the size of incrementals is running defragmentation tools, at least when using Macrium. The thing is, Macrium’s image (not file) backups only look at the sectors that are marked as containing the contents of files (as opposed to free sectors), if I understand them correctly. If you defragment your file system, many of the sectors will change because the defragmenting tool has to shift a lot of files around to eliminate the fragmentation. The net result is that Macrium thinks that many or even most sectors have changed and it includes all of them in new incrementals. I think this is actually a particularly troubling drawback of looking at sectors instead of files (or insisting on defragmenting) because there doesn’t seem to be a way to change things back other than just restoring from a previous backup, which of course you don’t want since you’re trying to make a new incremental.
This is incorrect.
Image backups look at files, regardless of how they’re laid out on disk. Defragmenting does NOT affect this.
This is an option to do a sector-by-sector copy (and many other “imaging” programs operate at the sector level) in which case your comment would be correct. But it’s not Macrium’s default, nor is it my recommended, behavior.
I don’t know if Mike’s reasoning is quite correct, but I have certainly noticed that Differential backups (In my case) have a sudden increase in size after drive de-fragmentation. My first experience of this was with Acronis True Image when creating standard differential images (not sector-by-sector), and found that turning off the schedule for windows de-fragmentation cured the problem! I have since tried using different de-fragmentation software (O&O, Defraggler etc) to see if this made a difference, but it doesn’t. I’m currently trying out Macrium Reflect Free, and had hoped that it wouldn’t suffer the same problem as Acronis, but again, there is a sudden increase in file size after de-fragmenting the drive!
I’m pretty sure that Macrium includes the directories in every incremental backup. On a server with over a million old files, that in itself is sizable.
This is why I prefer to have my OS and data on different partitions. I back up the data partition every day, and the system partition less frequently.
I use a backup system that is probably similar to others. After formatting the ext backup drive, made a full image copy that was 65 GB. After that, the differentials were about 6-10 GB. A week later it was 120 GB, almost twice the size of the original full image.
After that, differentials averaged 6-10 GB, but a week later, it was 135 GB, twice the size of original full image. Perhaps those giant images included smaller ones from before? I have no idea.
I had the same question as the original poster after I set up and ran EaseUS Todo. I expected the first *full* backup would be large, but why were the *incremental* backups after that so large, as well?
Turns out, it was the way I had set up the Image Reserve Strategy. By choosing, “Don’t delete the first image,” EaseUS Todo makes TWO *full* backups in a row according to the schedule you have established. Also, if you choose to enter the number “1” in the box “I will preserve the last ( x ) backups,” it continues to make *full* backups after that.
Hello Leo,
Something is bugging me right now in Symantec Backup Exec 15. I’ve done a full back up of a job followed by an incremental two days later. The full was 310 GB in size whereas the incremental was 281 GB. After that, each time I do another incremental, it backs up 281 GB of data AGAIN even though I did not add anything new or modified anything on the server. Why does it continue to back up 281 GB instead of 0 GB for every incremental that I run?
Thanking you in advance Leo.
Well, lots of files are constantly changing – Windows is the primary culprit – but that does seem excessive. I’d see if you can list the contents of just the incremental to see what, exactly, it contains. Unfortunately I’m not familiar with that backup program so I can’t tell you how.