In this guide 7 sections
The difference between incremental and differential backup is what each one copies after the full backup. An incremental backup copies only the changes since the last backup of any kind, so it is fast and uses less storage space, but every backup in the chain is needed to restore data. A differential backup copies all the changes since the last full backup, so it grows each day but restores from just two backup sets: the last full backup and the latest differential backup. For most small businesses, modern incremental backup with regular synthetic full backups is the right backup method, provided restores are tested.
The three backup types explained
Full backup. The backup process copies all the data: every file, and for image backups the operating system and applications too. A full backup is the simplest to restore, but it has the longest backup time and uses the most storage space. Every backup strategy starts with an initial full backup.
Incremental backup. After you perform a full backup, each subsequent incremental backup copies only the changed data since the last backup, whether that was the full backup or the previous incremental. Incremental backups copy only the changes, so backup windows stay short.
Differential backup. After the full backup, each differential backup copies all the files that have changed since the last full backup. Each day's differential includes the day before's modified data too, so the backup set grows until the next full backup.
How incremental and differential backups work over a week
Full backup on Sunday. One file changes each day after that.
| Day | Incremental backup copies | Differential backup copies |
|---|---|---|
| Monday | Monday's data changes | Monday's changes |
| Tuesday | Tuesday's changes only | Monday + Tuesday |
| Wednesday | Wednesday's changes only | Monday + Tuesday + Wednesday |
| To restore data on Thursday you need | Sunday full backup + Mon + Tue + Wed incrementals | Sunday full backup + the last differential backup (Wednesday) |
Incremental vs differential backup compared
| Incremental backup | Differential backup | |
|---|---|---|
| Backup speed | Fastest: only the changes since the last backup | Slows down as more data changes since the last full backup |
| Storage space | Less storage space | More storage space, growing until the next full backup |
| Recovery time | Slower: every backup in the backup chain is needed | Faster: last full backup + latest differential backup |
| Risk of a failed recovery | A damaged backup in the chain can affect every later restore | Only that day's differential is affected |
| Best for | Tight backup windows, frequent backups, cloud and offsite backup | Simple on-site backup servers where recovery time matters most |
Which backup method is right for you?
The right backup method depends on three things: how much data changes each day, how long your backup windows are, and how fast you need to recover in a disaster recovery scenario.
- Choose incremental backup if you back up often, have limited bandwidth or storage, or send backup data offsite or to the cloud.
- Choose differential backup if you run a single on-site backup server, have plenty of disk space, and want the simplest recovery process.
- Use both with synthetic fulls if your backup software supports it (most business backup tools do).
What modern backup tools actually do
Most business backup software now uses an incremental forever backup: one initial full backup, then only incremental changes, with the backup software periodically building a synthetic full backup from the existing backup files. That gives you incremental backup speed with a short restore chain. The choice between incremental or differential backups matters less than how well you ensure data backup security:
- Keep a copy attackers can't change. Store at least one copy offline or immutable, with separate credentials. Ransomware targets the backup server first.
- Follow 3-2-1 for data protection. Three copies of your critical data, on two different types of storage, with one copy offsite.
- Test the recovery process. The Essential Eight asks for restoration to be tested. A backup you've never restored is a guess, and a failed recovery is how lost data becomes permanent data loss.
Static Computers' backup strategy
For clients, Static Computers backs up Microsoft 365 and Google Workspace up to four times a day and backs up on-premises servers, keeps an immutable copy offsite, and tests data recovery regularly. See backup and disaster recovery.