What Is the Difference Between a Differential and an Incremental Backup?

What Is the Difference Between a Differential and an Incremental Backup?
Current backups are the only way to recover from a ransomware
infection and remain the cornerstone of any disaster recovery plan.

Full backups take a snapshot of all data from a specific point in time.  Although they're necessary, they are also taxing on storage space. Luckily, you can take one full backup and use differential and incremental backups to conserve storage space. Here is a brief explanation of both types.

Differential Backups

Differential backups are the next-best option compared to full backups. You still need a full backup, because differential backups are based on the most recent full backup.

Suppose you take a full backup on Sunday, and on Monday you decide to take a differential backup. A differential backup contains all files and data changed since Sunday's full backup. If you take another differential backup on Tuesday, it will contain all files changed since Sunday's full backup. Each day you take another backup, all files changed since the full backup are archived.

Differential backups are usually combined with full backups each week. As time passes, the differential backup gets larger and larger as more files and data change. For this reason, it's best to create a full backup frequently and then use differentials for a few weeks.

Incremental Backups

There is a slight difference between a differential backup and an incremental one. Differentials rely on access to a full backup. Incremental backups don't need a full backup to save files.

Incremental backups archive files that changed according to the last backup. The last backup could be a full backup or another incremental backup. These backups take the least amount of storage space, so they are preferred over differentials.

As with any type of backup system, you should always take a full backup first. For instance, if you take a full backup on Sunday, you could then take an incremental on Monday. All files that changed since the full backup would be saved. You then take a backup on Tuesday. All files that changed since Monday's incremental backup would be saved. Notice the slight difference: differentials always work with the full backup, but an incremental is only files that changed since the last incremental or full backup.

Full-Image Backups

Incremental and differential backups are useful for daily backup procedures, but you have the option of one more type. Full-image backups, which are standard only after initial server setups, provide a complete snapshot of all applications and data on a drive. Incremental and differential backups archive only data. With a full-image backup, you take a snapshot of the entire hard drive as-is, which means you can copy the image to a new hard drive should the current one crash. All applications and data are stored in the image, so you don't need to install anything or transfer files when the image is recovered. With the image copied to a new hard drive, your server is up and running within a few minutes.

Full-image backups are convenient, but they require the most storage. If you've used 1TB of space on your hard drive, you need at least 1TB to store your snapshot. This type of backup is also expensive, so most administrators take a full image backup once all programs and drivers are installed on the server. After the full-image backup is created, it's stored as an archive in case the current hard drive crashes.


All organizations should incorporate at least one of these backup solutions. Backups are a part of disaster recovery plans, which are a critical part of business continuity. Losing data can destroy a business, so create a backup plan to avoid such a disaster.