Backup Types: Full, Incremental & Differential — What Each One Actually Trades Off

Backup & Disaster Recovery Basics

Chapter 2 · Backup Types: Full, Incremental & Differential — What Each One Actually Trades Off

Understanding backup types here isn't about choosing one — that's an architecture decision that's usually already made before a ticket ever reaches you. It's about understanding what's actually sitting in the backup catalog, so that when a restore is requested, you know how many pieces it actually needs, roughly how long it should take, and where a single broken piece could cause the whole thing to fail.

Full Backup

A complete copy of everything, every time it runs.

Restore: one backup set, nothing else needed.

Cost: largest storage footprint, longest backup window.

Incremental Backup

Only what changed since the last backup of any kind.

Restore: the full backup, plus every incremental since then, in order.

Cost: smallest, fastest individual job.

Differential Backup

Everything changed since the last full backup — cumulative, not chained.

Restore: the full backup, plus only the most recent differential.

Cost: grows larger each day until the next full backup runs.

Worked Example: Restoring Thursday's Data

Say a full backup runs every Sunday, with a daily job Monday through Saturday. Here's what actually has to be restored to recover Thursday's data under each scheme:

Scheme	What Monday–Thursday's jobs each contain	What's needed to restore Thursday
Incremental	Each day: only what changed since the previous day's job	Sunday's full + Monday's + Tuesday's + Wednesday's + Thursday's incrementals, applied in order
Differential	Each day: everything changed since Sunday's full (cumulative)	Sunday's full + only Thursday's differential

The incremental scheme's daily jobs are individually smaller and faster — but restoring Thursday means correctly applying five separate pieces in the right order. The differential scheme's daily jobs grow larger each day — but restoring Thursday only ever needs two pieces, regardless of which day of the week it is.

An incremental chain is only as strong as its weakest link

If Tuesday's incremental is missing or corrupted, Wednesday's and Thursday's incrementals become useless too — they only describe changes relative to the day before, so the chain breaks at exactly the point of the bad link, taking everything after it down with it. A differential scheme doesn't have this problem: each day's differential stands on its own, independent of every other day's. This is exactly the kind of restore failure Chapter 7 covers in depth.

Comparing the Tradeoffs Directly

	Full	Incremental	Differential
Backup window	Longest	Shortest	Middle, grows over the week
Storage used	Highest	Lowest	Middle, grows over the week
Restore complexity	Simplest — one set	Most complex — full chain, in order	Simple — two sets, any day
Single point of failure risk	Only the one backup itself	Any link in the whole chain	Only the full backup or the one differential used

Why This Matters on a Real Ticket

Knowing which scheme is in use tells you, before you even start, roughly how long a restore should take and how many pieces need to come together correctly. An incremental-based restore spanning two weeks means confirming every single day in that chain is present and intact — not just the day being restored to. A differential-based restore only ever needs the last full backup and one more file, regardless of how long ago the full backup ran.

Hands-On Exercises

Exercise 1

Using the worked example, explain why restoring Thursday's data under the incremental scheme requires five separate pieces, while the differential scheme only requires two.

📄 View solution

Exercise 2

Explain why a corrupted Tuesday incremental also breaks Wednesday's and Thursday's restores, even though those two files themselves are perfectly intact.

📄 View solution

Exercise 3

Explain why this chapter frames understanding backup types as something a support technician needs for reasoning about restores, rather than as an architecture decision the technician needs to make.

📄 View solution

Chapter 2 Quick Reference

Full: everything, every time — simplest restore, highest cost
Incremental: changes since the last job of any kind — smallest jobs, but restore needs the full chain in order
Differential: changes since the last full backup — restore only ever needs the full backup plus one differential
An incremental chain is only as strong as its weakest link; a differential scheme doesn't share that risk
Knowing the scheme in use tells you how many pieces a restore needs before you even start
Next: Chapter 3, the 3-2-1 rule and why a backup stored with what it protects doesn't count