Full vs Incremental vs Differential Backups

Full vs Incremental vs Differential Backups

Photo by panumas nikhomkhai on Pexels

Choosing the right backup type affects how much storage you use, how fast backups run, and how quickly you can restore. Let's break down the three primary backup types and when to use each.

Full Backup

A full backup copies all selected data every time it runs.

• Pros: Simple to manage. Restoring is fast — you need only one backup set. Easy to verify and archive.
• Cons: Takes the most time and storage. Running daily full backups of 500GB requires 500GB every day. Bandwidth-intensive for off-site copies.
• Best for: Small datasets (<50GB), weekly baseline backups, or compliance scenarios requiring complete periodic snapshots.

Incremental Backup

An incremental backup copies only data that changed since the last backup of any type (full or incremental).

• Pros: Fastest backups. Minimal storage. Ideal for daily runs on large datasets.
• Cons: Restores are slower — you need the last full backup plus every incremental in sequence. If any intermediate backup is corrupt, the chain breaks.
• Best for: Large datasets (>100GB), environments with frequent small changes, daily off-site backups over limited bandwidth.

Differential Backup

A differential backup copies all data that changed since the last full backup, regardless of whether differential backups have run in between.

• Pros: Faster restore than incremental — you need only the last full + the latest differential. More resilient than incremental (no dependency chain).
• Cons: Each differential grows larger over time as it accumulates all changes since the full. More storage than incremental, less than full.
• Best for: Mid-size datasets (50–500GB), environments needing faster restores than incremental allows but less storage than full.

Comparison Summary

Recommended Strategy: Full + Incremental (Forward-Delta)

The best practice for most environments combines both: run a full backup weekly and incremental backups daily. Modern tools like BorgBackup and Restic use deduplication to achieve the efficiency of incremental backups with the simplicity of full backups — every backup appears to be a full backup, but only changed blocks are stored.

Sample Schedule with BorgBackup

# Cron: weekly full baseline + daily incremental
# Borg handles this automatically with deduplication

# Daily at 2 AM
0 2 * * 1-6  /usr/local/bin/borg create --compression lz4 \
  /backups/repo::{now} /home /var/www /etc

# Weekly full + prune on Sunday
0 2 * * 0  /usr/local/bin/borg create --compression lz4 \
  /backups/repo::{now}-weekly /home /var/www /etc
  /usr/local/bin/borg prune /backups/repo \
  --keep-daily=7 --keep-weekly=4 --keep-monthly=6

Key Takeaways

• Full backups are simple but storage-heavy; use weekly for baselines.
• Incremental backups are fast but require the entire chain for restore.
• Differential backups are a middle ground — faster restore than incremental, less storage than full.
• Deduplicating tools (Borg, Restic) give you the best of all worlds — incremental storage with full-backup restores.