Helping people with computers... one answer at a time.

If you've been backing up regularly you'll probably have a full backup and a collection of incremental's. We'll look at how they're used.

What do I do with incremental backups? Do I have to apply those separately? Yesterday my full backup was 25+ GB and today the incremental backup is 1.2+ GB. Do I restore both?

I actually received a couple of questions in this vein after posting the video Restoring An Image Using Acronis TrueImage Home.

It's clear that exactly how incremental backups are used come restore time is ... unclear. I'll run through a conceptual example of how they're used that'll hopefully make things a little clearer.

Fortunately, you actually don't need to do anything all that different, or even think about it that much. Yes, you restore both, but it's all done in a single step.

"The good news is that this is an annoyance, not a catastrophe, since you've been backing up regularly!"

Usual disclaimer: I'm using Acronis TrueImage as the model for my example. Different backup tools may work differently, but the concepts are fairly generic. And of course I'm oversimplifying somewhat to explain the concepts; I'm not describing the exact details of how the programs actually accomplish the task, mostly because I don't know those details.

Let's say you've been backing up, as you should, and have elected to take a periodic full backup, perhaps monthly, and daily incremental backups. Let's say you take your full backup on the first day of every month. On the 5th of the month you'll have this:

Day of Month Backup Taken Backup Contents
1st Full Backup All files as of the 1st
2nd Incremental #1 Files updates between the 1st and 2nd
3rd Incremental #2 Files updates between the 2nd and 3rd
4th Incremental #3 Files updates between the 3rd and 4th
5th Incremental #4 Files updates between the 4th and 5th

On the 5th you've got a single full backup, probably fairly large, and 4 additional incremental backups.

Now, let's assume that on the 5th your hard drive dies. The good news is that this is an annoyance, not a catastrophe, since you've been backing up regularly!

You replace the hard drive, you insert your backup software's rescue CD and boot from that, and you prepare to restore your machine's entire image.

The backup software will likely provide you with a list of potential backups you could to restore to. You could choose:

  • The full backup taken on the 1st - which would restore your machine and all files to the state as of that day.

  • The incremental backup of the 2nd - which would restore to that day.

  • The incremental backup of the 3rd.

  • The incremental backup of the 4th.

  • The incremental backup of the 5th.

Basically, you have a choice at this point as to which day you would like to recover to. In most cases you want to recover to the most recent backup you have, so in our example you choose the incremental backup of the 5th.

Here's what (conceptually) happens:

  1. The backup program locates the most recent full backup and restores it, completely. In our example, that means the backup program goes back to the full backup you took on the 1st and restores it in its entirety to the machine.

  2. The backup program then locates the next incremental backup, and restores it. In our example that means the first incremental backup taken on the 2nd of the month is restored, overwriting any files restored in the previous step with any updates that occurred between the 1st and 2nd of the month.

  3. The backup program then restores the next incremental backup taken on the 3rd of the month overwriting any files updated between the 2nd and 3rd of the month.

  4. The backup program then restores the next incremental backup taken on the 4th of the month.

  5. The backup program then restores the next incremental backup taken on the 5th of the month.

The result when all this is done is that all your files have been restored, regardless of when they changed, and all are up-to-date as of the last incremental backup taken on the 5th.

(For the record, as I mentioned above backup programs rarely do this in sequence as I describe. They take more of a "figure it out and do it all at once" approach that actually only restores the most recent version of any file in a single pass.)

Now, there's an interesting implication based on how this all works:

You need all the backups, back to the most recent full backup. If you want to restore to the 5th, not only do you need the full backup taken on the 1st to be available, but you also need all the incremental backups taken in between. That implies that if any of the incremental backups are lost or corrupt, then you won't be able to restore past the date of the that just prior to the failure.

A full backup, on the other hand, stands alone; it is complete and self-contained. Though probably big.

Consider my own scenario - at the end of the month if I need to restore my machine I need all 30 incremental backups and the initial full backup to be present and correct in order to successfully restore my machine. If I need to restore on the 1st of the month, though, I only need that first full backup to be present.

That's why most backup strategies are based on a blend - periodic full backups to "reset the risk", followed by some number of incremental backups in between. It's not that things break that often - they don't - it's that these are backups we're talking about. The cost of failure is potentially high. Perhaps if you had infinite disk space you might even take daily full backups, but that's simply not practical.

Article C3882 - September 30, 2009 « »

Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

October 1, 2009 9:33 AM

Good Morning!

If I have the HD space available (1T external HD) and I make a full backup every day, can I safely delete all but the last 3?

Would all this writing, deleting and rewriting tend to wear out my HD sooner?

Thanks, Leo, for your great column!

You can keep as many, or as few, full backups as you like or feel the need for. They each stand alone, and represent the machine as of the date that the backup was taken. No, this won't have any appreciable additional wear on a a hard disk - many things we do are much more disk intensive.

Jeff Burns
October 6, 2009 10:44 AM

You used Acronis as your example for backing up. While the example you gave was helpful in a general sense, it does create a lot of manual requirement to replace the full backup periodically and then erase old incremental backups.

Acronis allows for other options which, when applied, allow for backups to be fully automatic, with no manual intervention required. My view is that when it comes to backups, fully automatic is the goal. Anything less is an accident waiting to happen.

The features I am referring to are using incremental or differential as your backup and checking the box that says to create a new full backup every "x" days. If you then select the feature to remove the old archives, that should result in a fully automatic backup, yes?

Now, I'm going to go try it for myself (LOL)!

Yes, acronis does have many interesting additional options, and I do plan to expand on them in the future. My initial focus is not really Acronis, but using Acronis as an example to demonstrate common backup scenarios that might also apply to other tools. In other words I'm sticking with basic features.
October 7, 2009 2:28 AM

personally, I prefer to use differential backups not incremental because you are only storing 1 full backup + 1 differential backup & the method referred to by Jeff Burns for periodic replacement of the full backup

That is a good compromise, but at the cost of disk space, if you're keeping those differentials. A differential is typically larger than an incremental.

Michael Horowitz
October 12, 2009 6:17 PM

@Shirley: Image backups are taken to protect against both hardware and software failures. If you are only concerned abut hardware failures then you only need the most recent few backups - how many is a matter of opinion.

However, if you are concerned with software problems too, then you want to have some backups that are very old because you never know when a software problem first occurred. They can easily go without being noticed for a long time, especially malicious software that is out to steal information from you.

Jim K.
July 9, 2010 8:24 AM

Excellent article. I learned a great deal about the various kinds of backups. I always knew that backing up was essential and did so. Then one day I had to reinstall Win Xp, reformat, and then bring back my data and applications. It was time consuming but worked very well and I was back in business. Using Acronis will give me additonal protection and make recovery much easier. Thank You for a great article.

Bob Z
April 26, 2011 12:18 PM

Your articles are always very well explained and written to be easily understood by novices while still being valuable to knowledgable readers. I am a fan of Acronis and have used it for a long time. However, I am still a little confused about incremental backups and have never created them. This may sound like a elementary question, but if you create a incremental backup, how is it differentiated from a full backup. Is it by naming?

Actually that's over here: What's an incremental backup?

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to to ask your question.