TechKnowSurge
TechKnowSurge Catalog Videos Backup Type: Incremental
VideoSecurityFree

Backup Type: Incremental

Incremental backups capture only the changes made since the last backup, using the archive bit to identify modified files and minimizing the time and storage required between full backups. Restoring from incremental backups requires applying the full backup first, followed by each incremental backup in sequence up to the desired recovery point.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Incremental backups are designed to reduce the time and storage overhead associated with full and differential backups by capturing only the data that has changed since the most recent backup of any kind. Rather than re-copying all modified files since the last full backup, as a differential does, an incremental backup records only what changed since the previous incremental, making each individual backup significantly smaller and faster to complete. This approach is well suited to environments where data changes frequently and continuous or near-continuous data protection is a priority. The mechanism that makes incremental backups possible is the archive bit, a flag embedded in file system metadata that is set whenever a file is created or modified. When an incremental backup runs, it identifies and backs up all files with the archive bit enabled, then clears that bit upon completion. The next incremental backup will only act on files whose archive bit has been set again by new changes, ensuring that no file is backed up redundantly within a single incremental cycle. Database environments handle this somewhat differently, typically capturing transaction logs rather than discrete file changes, but the underlying principle of recording only new activity remains the same. Restoring data from an incremental backup set is more involved than restoring from a full or differential backup. The process requires first restoring the baseline full backup to establish the complete data set, then applying each incremental backup in the exact order it was created, up to the point in time targeted for recovery. Every incremental snapshot in the chain must be available and applied sequentially, since skipping any one of them would result in an incomplete or inconsistent restore. This dependency on a complete backup chain is an important operational consideration when evaluating incremental backup strategies for disaster recovery planning.

What you'll learn

What's covered

Incremental Backups

Key terms

Incremental Backup
A backup type that copies only the data that has changed since the last backup of any type, minimizing storage use but requiring multiple restore steps.
Full Backup
A complete copy of all selected data, serving as the baseline backup type from which other backup strategies operate.
Archive Bit
A file system attribute flag that is set whenever a file is created or modified, signaling that the file needs to be backed up; certain backup types clear this bit to track which files have changed since the last backup.
Disaster Recovery
DR
The process and procedures for recovering IT systems and data following a disruptive event.
Recovery Point Objective
RPO
The maximum acceptable amount of data loss measured in time, defining how far back data must be recoverable.

Topics

Incremental Backup Backup Types Archive Bit Data Recovery Backup Restoration Data Protection

Transcript

The problem with a full backup is that it could take a long time, possibly even days, to do a backup, so it might not be efficient to do that. Same thing with a differential: if a lot of changes are happening between the times that we're taking that differential backup, that can be problematic.

How an Incremental Backup Works

An incremental backup solves that problem, because what it does is it does little backups all throughout maybe the day, or whenever you run it. What it's doing is it's just backing up the changes since the last backup.

So what we do at the beginning of the day is maybe we capture a full backup, and then every hour we're going to be doing an incremental backup. So at 9:00 a.m. we're backing up file one, because that's what's changed. At 10:00 a.m. it's file two and three. At 1:00 p.m. it's files four and five. At 2 p.m. it's file six.

The Archive Bit

So how does it know what files have changed? Well, it's that archive bit. That archive bit gets checked and then it backs those up. Now what will happen is, after it's done, it will uncheck those boxes. So they get unchecked and they don't get backed up the next archive bit. Instead, if another file changes then it gets backed up on that next archive, or that next incremental, and then that gets erased there. So only the files since the last backup get changed when you're doing incremental backups.

It's pretty great, because we do a full backup maybe overnight and then all those archive bits get unchecked, and then at 9:00 a.m. it sees that there's a file with a checked archive bit and it backs that up and then removes the archive bit. And then at 10:00 a.m. it sees that there's two more files that have the archive bit checked, so it backs those up and then unchecks that. And then at 1 p.m. it sees that there's two more files with the archive bit checked.

Databases

Incremental backups on things like databases function a little differently than what we've been talking about, so we're not going to get too in depth into that. But just know that what it's doing there again is it's backing up some of the transaction logs on the server.

Restoring

When restoring incremental backups, we're going to have to, first of all, restore the first full, so we get all the files in there. Then we restore all the changes that have happened since then. So we see that there's a change at 9:00 a.m., so we have to restore that. Same thing at 10:00 a.m., we have to restore those. And then at 1:00 p.m. we have to restore those. And at 2 p.m. we have to restore that. So we have to restore all of the files, all of the incremental backups, up to the point in time where we want to do that restore.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →