Download the authoritative guide: Enterprise Data Storage 2018: Optimizing Your Storage Infrastructure
The Incremental Backup
The incremental backup provides a much faster method of backing up data than a full backup. During an incremental backup only the files that have changed since the last full or incremental backup are included. Because of this, the time it takes to conduct the backup may be a fraction of the time it takes to perform a full backup. To determine whether a file has changed since the last full backup, the backup software checks a setting known as the ‘archive bit.’
When a file is changed in any way or copied from one area of the disk to another, the archive bit is set to indicate that, at the next scheduled backup, the file needs to be copied or archived. Full backups do not concern themselves with whether or not the archive bit is set before backing a file up, but they do clear the bit after the file has been copied to tape. Any files that then change have the archive bit set, indicating that they need to be backed up again.
Unlike differential, which does not clear the archive bit after copying a file, incremental backups clear the bit so that unless the file changes again, it does not get backed up unnecessarily. The use of the archive bit also allows you to visually see which files do need to be backed up.
The convenience of quicker backup times comes with a price — in this case, the restore time. When restoring from an incremental backup, you need the most recent full backup as well as every incremental backup since the last full backup. For example, if you were do a full backup Friday and incrementals on Monday, Tuesday, and Wednesday, and the server crashes Thursday morning, you would need four tapes — Friday's full backup and the incremental backups for Monday, Tuesday, and Wednesday.
The Differential Backup
Differential and incremental backups often get confused, but there's a clear distinction between the two. Whereas incremental backs up all the modified files since the last full or incremental backup, differential backups offer a middle ground by backing up all the files that have changed since the last full backup. Restoring differential backups is a faster process as only two tapes are needed — the last full backup and the latest differential.
Differential backups work well in environments that have a reasonably large window to conduct backups and that have the capacity to do so. In the case of differential backups, they work by looking for files that have the archive bit set, and then back up only those files.
As stated above, because differential backups copy any data that has changed since the last full backup, which would have cleared the archive bit, it does not change the state of the bit. The upside of this approach is that only two tapes are needed to effect a complete restore. The downside is that at each differential backup, there's a high probability that some data (that which has changed since the last full backup but not since the last differential) will be backed up more than once.
Synthetic Full Backup
One final backup method worth mentioning is the Synthetic Full Backup. Synthetic full backups are used when the backup window is too small for the other options. In a synthetic full backup, information is taken from a full backup and the differential or incremental to create a new full backup tape. This allows a full backup to be created offline, allowing the network to continue to function without any performance degradation or disruption to network users.