Types of Backup: Full, Incremental, Differential

Backup types are categorized by what data they copy and how they track changes: full, incremental, and differential are the three core methods, with synthetic full, mirror, and continuous data protection as common variations. This article explains each type, how they compare in speed and storage, and how to choose the right combination for your data.

Why Backup Type Matters

Choosing a backup type is a trade-off between three things: how long the backup takes, how much storage it uses, and how quickly you can restore when something goes wrong. A full backup copies everything every time—simple to restore but slow and storage-hungry. Incremental backups only copy what changed since the last backup of any type, making them fast and small, but restoring requires replaying every incremental in order. Differential backups sit in between: they copy everything changed since the last full backup, so they grow larger each day but only need the last full plus the latest differential to restore.

Most real-world backup strategies combine these types—for example, a weekly full backup with daily incrementals—to balance speed, cost, and recovery time.

The Three Core Backup Types

Full Backup

A full backup copies all selected data to the destination, regardless of when it was last changed. It creates a complete, standalone copy that can be restored without any other backup. This is the foundation of every backup strategy.

• Advantages: Simplest to restore; all data in one place; no dependency on previous backups.
• Disadvantages: Slowest to create; uses the most storage; repeated full backups duplicate unchanged data.

Full backups are typically run on a schedule—weekly or monthly—because they take time and consume bandwidth. For example, a 500 GB database full backup might take hours and require 500 GB of storage, while an incremental might take minutes and use only a few gigabytes.

Incremental Backup

An incremental backup copies only the data that has changed since the last backup of any type (full or incremental). After a full backup on Sunday, Monday’s incremental captures Monday’s changes, Tuesday’s captures Tuesday’s changes, and so on.

• Advantages: Fastest to create; smallest storage footprint; minimal network load.
• Disadvantages: Restore requires the full backup plus every incremental in order; if one incremental is corrupt, you lose everything after it.

Restoring from incrementals means the system must apply the full backup, then each incremental sequentially. For example, if you have a full backup from Sunday and incrementals from Monday through Friday, restoring to Friday’s state requires all five files. This makes restore times longer and adds risk if any incremental is missing or damaged.

Differential Backup

A differential backup copies all data that has changed since the last full backup, regardless of whether a previous differential already captured it. After a full backup on Sunday, Monday’s differential captures Monday’s changes; Tuesday’s differential captures Monday and Tuesday’s changes; Wednesday’s captures Monday through Wednesday’s, and so on.

• Advantages: Restore only needs the last full backup plus the most recent differential—two files total; simpler than incrementals.
• Disadvantages: Each differential grows larger as the week progresses; storage usage increases; backup time increases each day.

Differential backups are a middle ground: they take longer than incrementals but much less than a full backup, and they are easier to restore because you only need the last differential. However, if you run differentials for weeks without a new full, they become nearly as large as a full backup.

Common Backup Strategies

In practice, IT departments and home users rarely use a single type. Instead, they combine them into a rotation that fits their recovery needs.

• Full + Incremental: Weekly full, daily incremental. Minimal storage and backup time, but restore requires all incrementals.
• Full + Differential: Weekly full, daily differential. Restore is two files, but storage grows through the week.
• Grandfather-Father-Son (GFS): Daily incrementals, weekly differentials, monthly fulls. Retains multiple restore points for long-term archiving.
• 3-2-1 Rule: Keep three copies of your data, on two different media, with one copy offsite. This is a best practice, not a backup type, but it influences how you combine types.

Other Backup Types You May Encounter

Synthetic Full Backup

A synthetic full backup creates a full backup by combining the last full backup with subsequent incremental backups, without reading the source data. The backup software assembles the new full backup from existing backup files. This gives you the restore simplicity of a full backup while only transferring the small incremental data over the network.

Mirror Backup

A mirror backup creates an exact, byte-for-byte copy of the source data, and it keeps the destination identical to the source in real time. When you delete a file from the source, it is deleted from the mirror as well. This means a mirror does not protect against accidental deletion or ransomware—it simply reflects the current state. Mirrors are often used for instant failover, not for historical recovery.

Continuous Data Protection (CDP)

CDP records every change to data as it happens, often at the block level, so you can restore to any point in time—down to the second. This is the most granular backup type, but it requires significant storage and software infrastructure. It is commonly used for databases and virtual machines where losing even minutes of data is unacceptable.

How to Choose the Right Backup Type

There is no single “best” backup type; the right choice depends on your recovery objectives and your environment.

• Recovery Time Objective (RTO): How long can you afford to be down? Full backups restore fastest; incrementals require applying many files.
• Recovery Point Objective (RPO): How much data can you afford to lose? More frequent backups (incrementals or CDP) reduce data loss.
• Storage capacity: Incrementals use the least space; fulls use the most.
• Network bandwidth: If backups run over a slow link, incrementals are attractive.
• Complexity tolerance: More backup types in the rotation means more to manage and more to go wrong.

For a typical small business, a weekly full backup plus nightly incrementals is a common starting point. For a home user with a few hundred gigabytes, a full backup to an external drive plus a cloud backup service might be sufficient.

Common Mistakes and Misconceptions

• Mistaking a mirror for a backup: A mirror replicates deletions and corruption; it is not a historical backup.
• Not testing restores: A backup that has never been restored is not a backup. Test restores regularly.
• Assuming incrementals are always better: They save time and space, but they increase restore complexity and risk.
• Ignoring offsite copies: A fire or theft can destroy both source and local backup. Keep one copy offsite.
• Misunderstanding differential growth: Differentials grow every day; if you don’t run a new full, they become as large as a full backup.

Frequently Asked Questions

What is the difference between incremental and differential backup?

An incremental backup copies only changes since the last backup of any type, so it is small and fast but requires all previous incrementals to restore. A differential backup copies all changes since the last full backup, so it grows larger each day but only needs the last full plus the latest differential to restore.

Which backup type is fastest to restore?

A full backup is the fastest to restore because it is a complete, standalone copy. Differential restores are also quick because they only require the last full and the latest differential. Incremental restores are the slowest because they require the full backup and every incremental in sequence.

Can I use only incremental backups without a full backup?

No. Incremental backups only capture changes since the last backup, so without a full backup there is no baseline. The first backup in any strategy must be a full backup (or a synthetic full built from a previous full and incrementals).

How often should I run a full backup?

It depends on your data change rate and storage capacity. A common schedule is a full backup weekly, with daily incrementals or differentials in between. If your data changes rapidly or your RPO is very low, you might run fulls more often or use CDP.

Does a mirror backup protect against ransomware?

No. A mirror replicates the current state, so if ransomware encrypts your files, the mirror will also be encrypted. To protect against ransomware, you need versioned backups (full, incremental, or differential) that retain historical copies of files.

Related

• Restore Closed Tabs? How to Reopen in Any Browser
• Kodi vs Plex: Which Media Server Is Right?
• Email vs Fax: How Each Works, Compared