What is a differential backup?
A differential backup copies every file that has changed since the last full backup. It is a backup type of its own, not a kind of incremental: an incremental copies only what changed since the last backup of any type, while a differential always measures from the last full. That makes each differential cumulative.
How a weekly cycle works
Say a full backup runs every Sunday and a differential runs every other night:
- Monday's differential holds Monday's changes.
- Tuesday's holds Monday's and Tuesday's changes.
- It grows every night until Saturday's holds the whole week's changes. Sunday's full backup starts the cycle over.
If the drive fails on Thursday before that night's backup, you restore Sunday's full backup and then Wednesday's differential: two backup sets, however many days have passed. With incrementals you would need Sunday's full plus Monday's, Tuesday's and Wednesday's incrementals, applied in order.
Backup types compared
| Type | What it copies | Backup time and space | To restore |
|---|---|---|---|
| Full | Everything selected | Slowest, largest | The full backup alone |
| Incremental | Changes since the last backup of any type | Fastest, smallest | The full plus every incremental since, in order |
| Differential | Changes since the last full backup | Grows each day until the next full | The full plus the most recent differential |
| Synthetic full | A full backup assembled on the backup system from an earlier full and later incrementals | Light on the source system, since it isn't read again in full | The synthetic full alone |
The archive bit
Classic Windows backup programs track changes with each file's archive bit (archive attribute), which Windows sets whenever a file is created or modified. Full and incremental backups clear the bit after copying a file. A differential backup leaves it set, which is why the next differential copies the same files again plus any new changes. Many modern backup tools track changes in other ways, such as change journals or block-level tracking, but the full, incremental and differential logic stays the same.
For the CompTIA A+ exam
Core 2 (220-1202) objective 4.3 covers backup and recovery. Be ready to compare backup types by what they copy and what a restore needs: a differential restore takes the last full plus the most recent differential, while an incremental restore takes the last full plus every incremental since. Pair that with the 3-2-1 rule: keep three copies of your data, on two different types of media, with one copy offsite.