What is the difference between full, incremental and differential backups?

"Full weekly, incremental daily" is the schedule most backup tools suggest by default. It made sense for the tools it was designed for, and it explains a lot about how the alternatives work. Every example below uses one week of nightly backups, Sunday to Saturday, and asks the same question: what does it take to restore Friday?

What is a full backup?

Every night copies all of the data. To restore Friday you need one backup, Friday's, and nothing else. Losing one night's backup loses only that night, because each one stands alone.

The cost is that you read, send and store everything every night. Seven nights means seven full copies of the server.

What is an incremental backup?

Sunday is a full copy. Each later night copies only what changed since the night before. Nights are small and quick.

The cost shows up at restore time. Friday needs Sunday's full plus every incremental from Monday to Friday, applied in order: six backups. They form a chain, and the chain is only as strong as its weakest link. If Wednesday's backup is lost or damaged, Thursday, Friday and Saturday can't be restored either, until the next full starts a new chain.

What is a differential backup?

Sunday is a full copy. Each later night copies everything that changed since Sunday, so Monday's is small and Saturday's is the biggest of the week.

Friday needs two backups: Sunday's full and Friday's differential. Losing Wednesday loses only Wednesday, because each differential depends only on the full. Losing the full loses the whole week.

What is incremental forever?

After the first full, each night sends only the changed data, and the storage side keeps one copy of each block. Each night's restore point is a complete list of the blocks that made up the data on that night.

So nights stay small, like incrementals, and every night is a complete, independent restore point, like a full. There is no chain to replay. A Friday restore reads Friday's list and fetches exactly those blocks, wherever and whenever they were first stored. Removing one restore point doesn't affect any other.

The trade-off is that one stored block can be shared by many restore points, so a damaged block affects every point that uses it. That is why every point needs verifying after it is written, not just a successful upload.

Why do backup schedules take a full every week?

To start a new chain. With incrementals, a weekly full keeps restores short (fewer incrementals to apply) and limits how much a broken link can destroy.

Incremental forever has no chain, so a weekly full has nothing to fix. What it still needs is a check on change detection. Skipping files whose size, modified time and file ID haven't changed is fast, but a program can change a file and keep its old modified time, so a quick check can miss it. A periodic full re-read of every file catches those changes, and it sends and stores about what a normal night does.

Which backup type should you use?

For file servers backed up every night, incremental forever with deduplication and verification: small nightly transfers, one-step restores and no chain to break. Fulls still make sense for small data sets where a full copy is cheap. Differential is a middle ground that some older tools use.

If you want a second independent copy, send it to a second destination. A second full to the same storage doesn't give you one: with deduplication, the same blocks are stored once.

How does MoorNest handle full and incremental backups?

MoorNest uses incremental forever. Every night is a complete restore point that stands on its own, so there is no chain and no weekly full. The agent skips files whose size, modified time and file ID haven't changed. A changed file is read in full, but only the blocks that changed are sent, and blocks the destination already holds aren't sent again.

Once a week (a plan option, every 7 days by default) the agent re-reads every file anyway, so a change that kept its old modified time is caught within a week. That night produces the same kind of restore point as any other. Each point is verified after upload.