incremental backup

What is an incremental backup?

An incremental backup is a backup type that only copies data that has been changed or created since the previous backup activity was conducted. An incremental backup approach is used when the amount of data that must be protected is too voluminous to perform a full backup of that data every day. By only backing up changed data, incremental backups save restore time and disk space.

Incremental is a common method for cloud backup, as it tends to use fewer resources, yet it can apply to traditional storage methods as well. Incremental backup must be implemented correctly and on an appropriate schedule to be successful.

How do incremental backups work?

An incremental backup scenario requires one full backup and then subsequent incremental backups over a period of time. For example, if a first full backup was performed on Monday, Tuesday's incremental will take a snapshot and back up all new or changed files since Monday's backup. However, Wednesday's incremental will only back up files that have changed since Tuesday's incremental backup and so on until another full backup is performed.

Because the initial full backup can take some time to complete, companies will often execute the full backup over a weekend when the data is less likely to be needed by the business.

To be able to restore up-to-date data or a full copy of the data, each of the incremental backups that were performed since the last full backup must be applied to that initial full backup. It can take some time to effectively reconstruct a new full backup to use for disaster recovery, but ostensibly the overall restoration process would still be faster and more efficient than trying to do full backups on a daily basis.

Common types of incremental backups

There are various types of incremental backups and different scenarios for updating data or creating new full backups of the data. Some of these variations include the following:

Synthetic full backup

A synthetic full backup is made by reading the previous full backup and subsequent incremental backups rather than doing another full backup that would require reading and copying the data from the primary storage. This approach helps avoid having to do traditional full backups, generally because the amount of data to be protected is so great that there wouldn't be enough time to complete a full backup without disrupting the business.

Most companies today have such large data stores that full backups are simply unmanageable. Traditionally, backup operators relied on the slice of time between the end of the workday and the following morning when the new workday begins -- a period called the backup window -- to complete all necessary backups. Today, with so many companies running round-the-clock operations or doing business internationally, the backup window has effectively disappeared.

File-level incremental backup

A file-level incremental backs up data on a simple, granular scale and works well with small data sets. When an incremental file is modified or updated, it's sent to a backup repository.

Block-level incremental backup

A block-level incremental is a common form of incremental backup in which the software backs up storage blocks that have been written rather than backing up files and folders. The written blocks contain either new or modified data. Block-level backups are more efficient than file-level backups because only the changed blocks are backed up as opposed to the software having to back up the entire file. Block-level access is how some storage devices and systems -- notably storage area networks -- access data, so this approach can also provide faster backups.

Byte-level incremental backup

Byte-level incremental backups are even more granular than block-level incrementals. With a byte-level incremental, the file system is monitored for individual bytes that have changed and then those bytes are backed up on an incremental basis. Because it deals with such small data elements, this approach yields the smallest possible backups.

Incremental forever backup

Also known as progressive incremental backups, this variation is designed to work on both cloud storage backup and local backup systems. After an initial copy of the data is made, the software only backs up new and modified data. Because the backup is disk-based, there's no need to create periodic full backups as the incremental changes can easily be applied to the locally stored full copy.

Enhanced incremental backup

Some backup vendors tout a feature often referred to as enhanced incremental backup that adds another layer of oversight to help ensure that backups are up-to-date and comprehensive. The enhanced part of these incrementals indicates that, in addition to identifying and backing up new and modified files, these backup apps can also recognize other changes such as files that have been moved or renamed.

Reverse incremental backup

A reverse incremental backup methodology is similar to a synthetic full approach. In a reverse incremental scenario, the process begins with the initial full backup. When the first incremental is created, it's applied to the initial full backup to produce a new full backup copy, without altering the original full backup. The next incremental is prepared by capturing the changes against the new full, and then it's used to create yet another, more up-to-date full backup.

In this manner, a full backup copy is always available, without having to go through the process of applying each incremental separately. Also, this approach makes it possible to revert to an earlier full copy if needed, to deal with incidents such as malware attacks.

Incremental vs. differential backups

Differential backups represent a twist on the traditional full-plus-incrementals backup scenario. As noted, a typical incremental process involves comparing the daily changes to the state of the data on the previous day. This creates a series of backup data sets that would all have to be applied to the original full backup copy to create an up-to-date full backup copy.

With differentials, each day's changes are compared to the original full backup and those changes are retained, so the effect is more cumulative than with incremental backups. It also means a full backup copy should be available for data recovery processes without having to apply a series of changed data files to the full copy.

Multilevel incremental backups are a variation of the differential backup methodology. In a multilevel incremental, backup levels are defined to decrease the amount of time it takes to restore a backup. Suppose that when crafting a backup strategy, an administrator creates a full backup, defined as Level 0, on Monday. Then, the administrator creates a Level 1 backup on Tuesday and a Level 2 backup on Wednesday. Under normal circumstances, if a user created and then restored an incremental backup on Thursday, it would require the backups from Monday, Tuesday and Wednesday to also be restored.

As an alternative, a backup administrator might create a Level 1 incremental backup on Thursday, which would include all the data created or modified since the last Level 1 backup was made -- in this case on Tuesday. Consequently, a full restoration would require restoring the backups from Monday, Tuesday and Thursday rather than restoring the backups from Monday, Tuesday, Wednesday and Thursday.

Incremental vs. continuous data protection

Continuous data protection (CDP) is a backup method that's related to incremental backups -- particularly the incremental forever approach -- in that only new and modified data needs to be captured and saved. The major difference between incrementals and CDP, however, is the backup speed, meaning the time between data backup operations.

CDP captures data changes as they occur or at very short intervals, such as every 10 minutes as opposed to incremental backup activities which tend to occur every 24 hours. The changes that CDP grabs and saves are usually applied quickly to the full data backup copy, so an up-to-date full backup is available almost instantly.

Advantages and disadvantages of incremental backups

The main advantage of incremental backups is that there are fewer daily backup files, allowing for shorter backup windows and less storage space. The principal disadvantage is that during a complete restore, the latest full backup and all subsequent incremental backups must be restored, which can take significantly longer than restoring a full backup. Even if only a single file must be restored, a series of incrementals must be applied to ensure that the latest version of the file is being recovered.

It's also imperative to check each incremental to make sure it's clean, uncorrupted and restorable. If one incremental in a backup chain is corrupted or otherwise unrecoverable, the process of recreating a full backup will be disrupted. This will require effectively abandoning the questionable incrementals and starting over with a new full backup. Many backup apps incorporate some level of virus detection during the backup process, which can help avoid ending up with corrupted incremental copies.

As with all data backup and restore activities, the process will need to be managed and monitored carefully to keep track of when a full or incremental backup was run, where it's stored and which copies of the data are safely stashed at an offsite location. In most cases, the backup software that's used for the incremental backup process provides detailed logs and other tracking information.

Incremental backup best practices

Organizations should follow a set of best practices once they implement a comprehensive incremental backup strategy. Some backup strategy best practices to all backup processes, but others are more specific to incremental backup, including the following:

• Combining incremental backup with other types. Since one type of backup isn't mutually exclusive to another, different types can be combined to reap the benefits of each one. For instance, on days of the week or in a month when there's less employee activity, the more comprehensive and time-consuming full backup type can take place.
• Optimizing processing power for recovery servers. To ensure all infrastructure requirements are in place when recovering data, recovery servers should be equipped with up-to-date processing power. Budgetary constraints can impede large-scale upgrades, in which case optimization might be stretched out over a longer period of time.
• Updating retention policies. Data retention policies could dictate that once data is used as intended, it's discarded. This will optimize incremental backups, so they only apply to critical data and ensure they don't require more effort and resources than necessary.
• Mandating periodic full backups. Mandating full backups periodically and ensuring they run smoothly ensures that incremental backups run successfully when needed. They should also be performed any time there's a major upgrade to an IT infrastructure, such as operating system updates.
• Considering different backup granularity levels. There are different levels of granularity that various backup providers offer. For higher granularity, a byte-level incremental backup ensures any changes to a byte of data since the preceding backup are saved. For lower granularity, a file-level incremental backup ensures any changes to a file since the preceding backup are saved.

Knowledge of the primary backup types is crucial for data backup professionals, but there are other key backup trends to be aware of. Explore five major data backup trends that should be top of mind for IT teams.