Count the Restore — TechKnowSurge

About this interactive

A full backup copies everything, whether it changed or not. Doing that every time costs storage, processing and time, so the other types copy less. A differential copies everything changed since the last full. In the lesson's example, with a full at 08:00, the 09:00 differential copies file 1, the 10:00 one files 1, 2 and 3, and the 11:00 one files 1, 2 and 3 again, though nothing changed in that hour. Each differential grows until the next full. An incremental copies only what changed since the last backup of any type: file 1 at 09:00, files 2 and 3 at 10:00, nothing at 11:00. Incrementals are smaller and quicker. The cost shows up at restore time. To get back the 15:00 state after a 12:00 full, incrementals need the full and every incremental since it, in order: 13:00, 14:00 and 15:00, four restores. Differentials need the full and the latest differential: two. A synthetic full combines the last full and the incrementals after it into a new full, built from the backups rather than the source, so restoring from it is one step. A common plan: a full over the weekend, when it has time to finish; a differential every night; incrementals through the day as often as the RPO needs, say every 15 minutes. Restoring a point mid-week then takes the full, the previous night's differential and each incremental since.

What you'll learn

Work out what a full, differential or incremental backup copies on a given schedule
Count the backups a restore needs under each schedule, including a synthetic full and a weekly full with nightly differentials and incrementals through the day

Aligned to

CompTIA A+ Core 2

4.3 Given a scenario, implement workstation backup and recovery methods.

CompTIA Server+

3.7 Given a scenario, implement backup and restore procedures.

CompTIA Security+

3.4 Explain the importance of resilience and recovery in security architecture.

NIST 800-53

CP-9 System Backup

ISC2 CISSP

7.10 Implement recovery strategies

Key terms

Full Backup: A complete copy of all selected data, serving as the baseline backup type from which other backup strategies operate.
Differential Backup: A backup type that copies only the data that has changed since the last full backup.
Incremental Backup: A backup type that copies only the data that has changed since the last backup of any type, minimizing storage use but requiring multiple restore steps.
Synthetic Full Backup: A backup type that combines a previous full backup with subsequent incremental backups to construct a new full backup without reading from the source system again.
Backup Frequency: How often backup jobs are scheduled to run, determined by the criticality of the data, the organization's Recovery Point Objective (RPO), and available storage resources. Higher-frequency backups reduce the amount of data that can be lost in an incident.
Restore: The process of retrieving and applying backed-up data to recover a system or dataset to a previous state.
Recovery Point Objective: The maximum acceptable amount of data loss measured in time, defining how far back data must be recoverable.

Topics

Full Backup Differential Backup Incremental Backup Synthetic Full Backup Interactive Fill In

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →