Differential vs Incremental backups

Hi everyone,

I'm currently going through Gibson's book, and I am super confused about the difference between differential and incremental backups.

Here's the definitions as provided in Gibson's book.

Differential backup- This backs up all the data that has changed or is different since the last full backup.

Incremental backup- This backs up all the data that has changed since the last full or incremental backup.

Deciding to include a word in the definition of that same word drives me nuts. Could anyone here help me understand what the actual difference between these is?

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

paul78

The key is what was last backed up.

For a differential backup - it's all the new files and changed files since the last FULL backup.

For an incremental backup - it's all the new files and changed files since the last backup.

So for example:

File A, File B, File C - Full backup is done

File D and File E are added so now we have File A, File B, File C, File D, and File E.

For a differential backup - the following files are backed up:
File D, File E

For an incremental backup - the following files are backed up:
File D, File E

Let's say we now add new file File F.

For a differential backup - the following files are backed up:
File D, File E, File F

For an incremential backup - the following files are backed up:
File F

Hope that makes sense.

Deus Ex Machina

Yeah, a bit. So there's no difference between differential and incremental backups for the first backup of the full one. Its the ones that come after that differentiate them.

paul78

That's correct. If the last backup was a full-backup - there would be no difference between an incremental and differential for the next backup.

TechGuru80

You can also think in terms of restoration of a system.

Differential: restore the full backup + the latest differential backup = the most recent state
Incremental: restore the full backup + every single incremental backup in order of oldest to newest (since full backup) = the most recent state

So think about if a incremental backup is corrupted...you are in trouble and can't restore any further than the backup before the corrupted backup. Incremental will be faster to complete a backup however because it is backing up much less data than a differential.

trojin

The most important to understand difference is behavior of archive bit.
Only full or incremental backups clear backup bit. Differential backups do not change archive bit so for next backup file looks like not backed up at all. So after full backup or incremental backups bit is cleared and new backup just skip these files

dontstop

paul78 wrote: »

The key is what was last backed up.

For a differential backup - it's all the new files and changed files since the last FULL backup.

For an incremental backup - it's all the new files and changed files since the last backup.

I like paul78's explanation. Here are some pictures to compliment

Deus Ex Machina

Visual aid helps illustrate it. Thanks.