13.3 Full and Incremental Backups

Before going into detail about backup hardware and archiving programs, you need to know about the two basic backup types:

Full backup An archive of everything on a filesystem or directory
Incremental backup An archive of all items that have changed since the last full backup

In large-scale operations, there are more kinds of backups, and you may hear of cumulative and differential backups. These are levels between incremental and full backups — that is, an incremental backup may contain all of the changes since the last differential backup, and the differential backup, in turn, could contain all changes since the last full backup. However, for small systems where you do backups by hand, it is reasonable to deal only with full backups and the incremental backups that build on the full backups.

The advantage to incremental backups is that they usually finish quickly and do not require much storage space. However, over time, the difference between the last full backup and the current state on the disk gets to be so significant that these advantages dwindle: the incremental backups start to take up as much space as the full backups, and it can be very difficult to merge an old full backup and a newer incremental backup if you ever need to restore a full set of files from the backups. In particular, files that you intentionally deleted between the two backups can reappear. Therefore, you need to do a full backups on a regular basis.

Systems administrators generally keep a set of full and incremental backups so that they can restore files that may have only existed for a short period of time. For example, if you have daily incremental backups that go back 30 days and a full backup from at least 30 days ago, you can restore any file that was on the filesystem at backup time during that time period. Of course, if you don't know the exact dates, finding the file can take a little time.

To restore a complete set of files, you need to extract the latest full backup first, then the latest incremental backup (unless, of course, the full backup is by chance newer than the incremental backup).