Full, Incremental, Differential, and Synthetic Full Backups for A+

The three classic types in NIST's words

NIST SP 800-34 Rev. 1 defines three of the four backup types that objective 4.3 lists. A full backup "captures all files on the disk or within the folder selected for backup." An incremental "captures files that were created or changed since the last backup, regardless of backup type." A differential "stores files that were created or modified since the last full backup."

The difference between the last two is one phrase: since the last backup of any kind, or since the last full. Questions about restore time, backup time, or storage almost always come back to that phrase. The fourth type on the list, the synthetic full, comes later on this page.

One week, two schedules

An office file share gets a full backup every Sunday night. On each weekday, a different 5 GB of files changes. The share's disk fails on Thursday at 2 p.m., so the goal is to restore it to its state as of Wednesday night's backup. The sizes are invented to keep the arithmetic simple.

To restore Wednesday night's state:

• Incremental: Sunday's full, then Monday, then Tuesday, then Wednesday. Four sets, applied in that order.
• Differential: Sunday's full, then Wednesday's differential. Two sets.

The trade-off in numbers: by Wednesday the incremental schedule has stored 215 GB and the differential schedule 230 GB, and each differential night took longer than the one before. NIST describes the same balance: incrementals use storage efficiently and run faster, while a differential restore "may require fewer media" but differentials take longer to complete as the week goes on.

If Tuesday's set is unreadable: the incremental restore can bring the share back to Monday night with confidence, but Tuesday's changes are gone, and applying Wednesday's set on top of Monday's leaves an inconsistent mix. The differential restore never needed Tuesday's set at all. A longer chain has more links that can break.

How backup software decides what changed

The traditional mechanism is the archive attribute, a flag Windows sets on a file when it is created or modified. A full backup copies everything and clears the flag. An incremental copies flagged files and clears the flag, so the next incremental starts fresh. A differential copies flagged files and leaves the flag set, so each differential keeps growing until the next full.

You can see both behaviors in robocopy. Microsoft's reference says /a "copies only files for which the Archive attribute is set" and /m copies those files "and resets the Archive attribute." That is differential-style versus incremental-style selection in one switch. Many modern backup products track changes in other ways, but the exam logic is the same.

Synthetic full: a full backup without reading the source

Suppose the office wants a fresh full every week but cannot afford to pull 200 GB across the network every Sunday. A synthetic full solves that. Commvault's documentation describes it as "created from the most recent full backup and subsequent incremental backups," and says it "does not actually transfer data from a client computer to the backup media."

In the example, a synthetic full built on Saturday from Sunday's full plus Monday through Friday's incrementals becomes the new starting point. Next week's restore chain starts from Saturday instead of reaching back to the previous Sunday. The source server does no extra work.

Recovery: where the restored files go

Objective 4.3 lists two recovery choices.

• In-place or overwrite puts the files back where they came from. It is the fastest path when the original location is healthy and the restored version is definitely the one you want.
• Alternative location restores to a different folder or machine. Use it when a user wants to compare an old version before replacing the current one, or when the original location is not yet trustworthy, for example after malware has been removed.

Testing and rotation

Backup testing. A backup that has never been restored is unproven. NIST says full and incremental backups should be "routinely conducted, stored offsite, rotated, and periodically validated." Objective 4.3 lists frequency under testing. Pick a schedule, such as restoring a sample folder every month, and write down the result.

Onsite vs offsite. An onsite copy restores quickly. An offsite copy survives a fire, a flood, or a theft that takes out the building.

Grandfather-father-son (GFS). A rotation scheme with three generations: daily backups (son), weekly backups (father), and monthly backups (grandfather). Each generation is kept for longer than the one below it, which gives you many recent restore points and a few older ones without keeping every backup forever.

The 3-2-1 rule. CISA's backup paper puts it as: keep 3 copies of any important file, one primary and two backups. Keep the files on 2 different media types. Store 1 copy offsite.

Pick the method for the scenario

Remember the boundary with Core 1: a RAID array keeps running when a drive fails, but it copies deletions and ransomware to every member. The RAID guide covers that difference. Backups are one part of objective 4 in Core 2. The rest of the domain, including change management and safety, is in the operational procedures guide. For how recovery targets are expressed as RTO and RPO at the next level, Passy's Security+ RTO and RPO guide uses one timeline to separate them.

Redo the one-week table for a Friday failure, then practice A+ Core 2 backup and recovery questions with Passy →.