Incremental Backup

What is an incremental backup?

An incremental backup is a backup type that only copies data that has been changed or created since the previous backup activity was conducted. An incremental backup approach is used when the amount of data that has to be protected is too voluminous to do a full backup of that data every day. By only backing up changed data, incremental backups save restore time and disk space. Incremental is a common method for cloud backup as it tends to use fewer resources.

How do incremental backups work?

An incremental backup scenario requires one full backup and then subsequent incrementals over a period of time. For example, if a full backup was performed on Monday, Tuesday's incremental will take a snapshot and back up all new or changed files since Monday's backup. However, Wednesday's incremental will only back up files that have changed since Tuesday's incremental backup and so on until another full backup is performed.

Because the initial full backup may take some time to complete, companies will often execute the full backup over a weekend when the data is less likely to be needed by the business.

To be able to restore up-to-date data or a full copy of the data, each of the incremental backups that were performed since the last full backup, must be applied to that initial full backup. It may take some time to effectively reconstruct a new full backup to use for disaster recovery, but ostensibly the overall restorate process would still be faster and more efficient that trying to do full backups on a daily basis.

Common types of incremental backups

There are various types of incremental backups and different scenarios for updating data or creating new full backups of the data. Some of these variations include:

• Synthetic full backup: A synthetic full backup is made by reading the previous full backup and subsequent incremental backups rather than doing another full backup that would require reading and copying the data from the primary storage. This approach helps avoid having to do traditional full backups, generally because the amount of data to be protected is so great that there would not be enough time to complete a full backup without disrupting the business. Most companies today have such large data stores that full backups are simply unmanageable. Traditionally, backup admins relied on the slice of time between the end of the workday and the following morning when the new workday begins—the backup window—to complete all necessary backups. Today, with so many companies running round-the-clock operations or doing business internationally, the backup window has effectively disappeared.
• File-level incremental backup: A file-level incremental backs up data on a simple, granular scale and works well with small datasets. When an incremental file is modified or updated, it is sent to a backup repository.
• Block-level incremental backup: A block-level incremental is a common form of incremental backup in which the backup software backs up storage blocks that have been written rather than backing up files and folders. The written blocks will contain either new or modified data. Block-level backups are more efficient than file-level backups because only the changed blocks are backed up as opposed to the software having to back up the entire file. Block-level access is how some storage systems—notably storage area networks (SAN)—access data, so this approach may also provide faster backups.
• Byte-level incremental backup: Byte-level incremental backups are even more granular than block-level incrementals. With a byte-level incremental, the file system is monitored for individual bytes that have changed and then those bytes are backed up on an incremental basis. Because it deals with such small data elements, this approach yields the smallest possible backups.
• Incremental forever backup: Also known as progressive incremental backups, this variation is designed to work on disk-based backup systems. After an initial copy of the data is made, the software only backs up new and modified data. Because the backup is disk-based, there is no need to create periodic full backups as the incremental changes can easily be applied to the disk-based full copy.
• Enhanced incremental backup: Some backup vendors tout a feature often referred to as “enhanced incremental backup” that adds another layer of oversight to help ensure that backups are up-to-date and comprehensive. The “enhanced” part of these incrementals indicates that, in addition to identifying and backing up new and modified files, these backup apps can also recognize other changes such as files that have been moved or renamed.
• Reverse incremental backup: A reverse incremental backup methodology is similar to a synthetic full approach. In a reverse incremental scenario, the process begins with the initial full backup (as with all other forms of incremental backups). When the first incremental is created, it is applied to the initial full to produce a new full backup copy, without altering the original full backup. The next incremental is prepared by capturing the changes against the new full, and then are used to create yet another, more up-to-date full backup. In this manner, a full backup copy will always be available, without having to go through the process of applying each incremental separately. Also, this approach makes it possible to revert to an earlier full copy if needed, to deal with incidents such as virus contamination.

Incremental vs. differential backups

Differential backups represent a twist on the traditional full-plus-incrementals backup scenario. As noted, a typical incremental process involves comparing the daily changes to the data to the state of the data on the previous day to create a series of backup data sets that would all have to be applied to the original full backup copy to come up with an up-to-date full backup copy. With differentials, each day’s changes are compared to the original full backup and those changes are retained, so the effect is more cumulative than with incremental backups. It also means that a full backup copy should be available for data recovery with having to apply a series of changed data files to the full copy.

Multi-level incremental backups are a variation of the differential backup methodology. In a multi-level incremental, backup levels are defined as a way to decrease the amount of time it takes to restore a backup. Suppose an administrator creates a full backup, defined as Level 0, on Monday. Then they create a Level 1 backup on Tuesday and a Level 2 backup on Wednesday. Under normal circumstances, if a user created and then restored an incremental backup on Thursday, it would require the backups from Monday, Tuesday and Wednesday to also be restored. As an alternative, a backup administrator might create a Level 1 incremental backup on Thursday, which would include all the data created or modified since the last Level 1 backup was made (in this case on Tuesday). Consequently, a full restoration would require restoring the backups from Monday, Tuesday and Thursday rather than restoring the backups from Monday, Tuesday, Wednesday and Thursday.

Incremental vs. continuous data protection (CDP)

Continuous data protection (CDP) is a backup method that is related to incremental backups—particularly the incremental forever approach—in that only new and modified data needs to be captured and saved. The major difference between incrementals and CDP, however, is the time period between those data backup activities.

CDP captures data changes as they occur—or at very short intervals, such as every 10 minutes—as opposed to incremental backup activities which tend to occur every 24 hours. The changes that CDP grabs and saves are usually applied quickly to the full data backup copy, so an up-to-date full backup is available almost instantly.

Advantages and disadvantages of incremental backups

The main advantage of incremental backups is that there are fewer daily backup files, allowing for shorter backup windows and lower storage space. The principal disadvantage is that during a complete restore, the latest full backup and all subsequent incremental backups must be restored, which can take significantly longer than restoring a full backup. Even if only a single file must be restored, the series of incrementals must be applied to ensure that the latest version of the file is being recovered.

It is also imperative to check each incremental to make sure it is clean, uncorrupted and can be restored. If one incremental in a series is corrupted or otherwise unrecoverable, the process of recreating a full backup will be disrupted. This will require effectively abandoning the questionable incrementals and starting over with a new full backup. Many backup apps incorporate some level of virus or malware detection during the backup process which can help avoid ending up with corrupted incremental copies.

And as with all data backup and restore activities, the process will need to be managed and monitored very carefully to keep track of when a full or incremental backup was run and where it's stored, and which copies of the data are safely stashed at an offsite location. In most cases, the backup software that is used for the incremental backup process will provide detailed logs and other tracking information.