The ransomware note appeared on a Tuesday morning, and at first the IT manager wasn't worried. The company backed up every server nightly to a storage appliance in the server room. Then he logged in to the appliance. It was joined to the domain, the attackers had domain admin rights, and the backup share had been encrypted two hours before the servers were.
Backups are the last line of recovery when everything else has failed, and attackers know it, which is why they go after backups first. On the CompTIA Security+ SY0-801 exam, backups sit under objective 3.4, which expects you to explain why resilience and recovery matter in security architecture. This lesson covers how backups differ from replication and snapshots, the full, incremental and differential types and the restore sets they create, offsite and offline copies, immutability, retention, scope and restoration testing.
A backup keeps older versions somewhere separate, which replication and snapshots don't
Replication copies every change from one system to another, either as the write happens or a few seconds later. That's excellent for availability, because the copy is current and can take over fast. It's useless against a bad change. Delete a folder, corrupt a database or let ransomware encrypt a volume, and replication faithfully copies the damage. RAID does the same within a single server.
A backup is a point-in-time copy stored separately from the original, with several versions kept so you can return to a moment before the problem began. Versioning is what makes it a backup.
Snapshots sit in between. A snapshot records the state of a volume or virtual machine at a moment, usually in seconds, by tracking which blocks change afterward. Snapshots are ideal for quick rollback, such as before a risky patch. But they normally live on the same storage system as the original, so a failed array or an attacker with admin rights takes them too. Windows Volume Shadow Copies are snapshots, and deleting them is a standard ransomware step, often one of these commands:
vssadmin.exe delete shadows /all /quiet
wmic.exe shadowcopy delete
Seeing either one in endpoint telemetry is a strong sign that encryption is about to begin. A snapshot becomes a backup only when it's copied to separate storage.
Full, incremental, and differential backups trade backup time against restore time
A full backup copies everything selected. It takes the longest and uses the most storage, but restoring from it needs only that one set.
An incremental backup copies only what changed since the last backup of any type. Each one is small and fast, but a restore needs the last full backup plus every incremental since, applied in order.
A differential backup copies everything that changed since the last full backup. Each differential is larger than the one before, until the next full resets it, but a restore needs only the last full plus the latest differential.
Traditionally, Windows backup software tracked this with the archive bit, a file attribute set whenever a file changes. Full and incremental backups clear the bit, and differential backups leave it set, which is why differentials keep growing. Modern products track changed blocks instead, but the logic is the same.
Here is a worked example. A server gets an 800 GB full backup on Sunday night, and about 30 GB of different data changes each day. It fails Thursday at 10 a.m., after Wednesday night's backup ran.
| Night | Incremental schedule | Differential schedule |
|---|---|---|
| Sunday | Full, 800 GB | Full, 800 GB |
| Monday | 30 GB, Monday's changes | 30 GB, changes since Sunday |
| Tuesday | 30 GB, Tuesday's changes | 60 GB, changes since Sunday |
| Wednesday | 30 GB, Wednesday's changes | 90 GB, changes since Sunday |
| Restore set on Thursday | Sunday full, then Monday, Tuesday and Wednesday incrementals | Sunday full, then Wednesday differential |
Both restores read the same 890 GB from backup, but the incremental restore depends on four sets, and if Tuesday's is unreadable, the chain breaks and the reliable recovery point falls back to Monday night. The differential restore needs two sets. Neither recovers the changes made Thursday morning before the failure, because no backup had captured them yet. How much data the business can afford to lose that way is the recovery point objective, covered in the recovery metrics lesson.
A common schedule is a weekly full with daily incrementals or differentials. Many current products run incrementals indefinitely and build a "synthetic full" on the backup server by merging earlier sets, so production doesn't have to send a full copy every week.