What is a Differential Backup?

Conceptually, differential backups sit between full and incremental backups. A differential backup is the middle ground in terms of efficiency and complexity. However, the majority of backups used these days are incremental.

A differential backup is a type of backup often used as part of a backup strategy. The first time a differential backup is run, a full backup is created. Subsequent backups save only changes made to files to the full backup. The first differential backup is indistinguishable from the first incremental backup. The top backup options only differ from the next backup onward.

To compare the changes made to files, various methods are used. The simplest scenario is a comparison of file timestamps from the last full backup and its current state. If the timestamp of a file in the current state is younger, the file has been modified since the last full backup and must be backed up again. Higher precision is achieved by calculating hash values from the contents of the two file versions. If the two hashes differ, the file has been modified and will be included in a differential backup.

To reconstruct a differential backup, the last full backup is restored first. The changes contained in the differential backup are then imported. Any data present in the full backup is overwritten in the process. The result is a mirror of the dataset at the time of the differential backup.

Differential backups are a good compromise between full and incremental backups in terms of efficiency. The complexity of creation and recovery is also lower for differential backups than for incremental backups and slightly higher than for full backups.

First of all, regularly created differential backups are more efficient than repeatedly creating full backups. That is because only the data that has changed since the last full backup is backed up. At the same time, differential backups are more robust than incremental backups. Unlike incremental backups, no chain of related backups is created. Instead, each differential backup refers only to the last full backup. This minimises the risk of the entire backup chain becoming unusable if a single link breaks.

To restore from a differential backup, only two data sets are needed: the differential backup and the associated full backup. Due to their low complexity, differential backups can be created and restored using on-board tools without the need for specialised software.

The disadvantage of a differential backup is that both the last full backup and the differential backup are required for a restore. If the full backup is corrupted, the differential backup is largely worthless.

Creating successive differential backups of the same full backup results in high redundancy of the backed-up data. For example, a differential backup from Thursday contains the changes from Monday, Tuesday, and Wednesday in addition to the full backup. It follows that the differential backup from Thursday is larger than the one from Wednesday and smaller than the one from Friday.

In general, a differential backup is suitable if the data volume doesn’t grow too much or if there are short intervals between the individual differential backups. To create and restore backups in an easy manner, without the use of specialist software or hardware, a differential backup is a good choice.

A traditional backup strategy used by businesses tends to include a full backup every weekend and daily differential backups. Following the 3-2-1-backup rule, at least one of the backups should be in the cloud. Due to large data volumes, incremental cloud backups are now more widespread.

The most widely used backup software today can create incremental backups. For example, to backup on a Mac, you can use the built-in software ‘Time Machine’ which generates incremental backups. Creating a backup in Windows 10 is very similar, regardless of whether you’re using the built-in Windows backup or the popular tool Robocopy Backup. In both cases the backups are created incrementally.

To create server backup with rsync, you can create a differential backup. The result is a differential backup that contains the changes since the last full backup in a separate directory. Let’s take a look at the individual steps:

First, a full backup is created:

The full backup is located in the directory target-path/source-dir/.

1. A differential backup of the changes is created afterwards:

The amended files are located in the directory diff-target/.

To restore data, it is enough to reverse the process. Again, two Rsync copy operations are required:

1. Copy a full backup back to the source:

1. Merge differential backup with full backup: