|
Backup Strategies series · Part 2 of 7 Backup Methods — Full, Incremental, Differential and MoreAll common backup methods compared — with recommendations per use case Full · Incremental · Differential · Synthetic · Snapshot · Image · GFS |
|
On this page
|
Choosing the right method
Part 1 (Backup Fundamentals) introduced the key metrics RTO and RPO. They drive which backup method makes sense for a given system — because every method solves a different trade-off between backup duration, storage footprint, restore time and complexity.
A nightly full backup is simple but consumes lots of storage and runtime. Incrementals are fast and lean, but the restore is more fragile. Snapshots provide minimal RPO but do not protect against hardware failure on their own. The right mix depends on workload, change rate and the storage budget on NAS, tape or in cloud repositories.
Backup methods at a glance
| Method | Backup time | Storage | Restore time | Complexity | Typical use |
|---|---|---|---|---|---|
| Full | long | high | short | low | Small data sets, archives |
| Incremental | short | low | long* | medium | Large data, daily job |
| Differential | grows | grows | medium | low | Compromise between full and incremental |
| Synthetic full | short | medium | short | high | Enterprise backup suites |
| Snapshot | seconds | minimal | seconds | medium | VMs, databases, NAS |
| CDP | continuous | high | seconds | high | High-availability systems |
* A classic incremental restore needs the last full plus all subsequent incrementals in order. Modern backup suites with synthetic consolidation largely eliminate this drawback.
Full backupSIMPLEST RESTORE HIGHEST FOOTPRINT REFERENCE BASELINE A full backup copies all data from the protected source on every run, regardless of changes. Advantage: each full backup is independently restorable; the restore is dead simple. Drawback: storage footprint and backup window grow linearly with data volume. Use case: manageable data volumes that do not change much each day (archives, configurations, small file servers). Also as the regular baseline for every other method — every incremental and differential needs a preceding full as anchor. |
Incremental backupFASTEST BACKUP MINIMAL FOOTPRINT RESTORE CHAIN An incremental backup stores only changes since the last backup — whether that was a full or itself another incremental. This produces tiny backup sets and short windows that fit easily into nightly slots. Restore drawback: you must replay the last full plus every subsequent incremental in sequence. With one full per week and six daily incrementals, worst case is 7 restore steps. Lose a single incremental and the chain is broken from that point on. Use case: large data sets with moderate change rate — classic file server, SAN storage, CAD data. Combined with synthetic consolidation (below), the restore disadvantage largely disappears. |
Differential backupRESTORE IN 2 STEPS STORAGE GROWS A differential backup stores all changes since the last full backup — not since the last backup of any kind. The differential set therefore grows daily until the next full. In return, the restore needs exactly two steps: the last full plus the latest differential. Use case: when restore speed and simplicity matter more than minimum storage — databases or ERP systems with tight recovery deadlines. Popular pattern: full on the weekend, differential daily. |
Synthetic full backupFAST RESTORE NO SOURCE LOAD ENTERPRISE FEATURE A synthetic full backup is a full backup the backup server builds itself from existing backup sets — without re-reading the source data. Concretely: last full plus all subsequent incrementals are consolidated on the backup target into a fresh full. Advantage: only the fast incremental runs against the source; the production server is not loaded. On the target side a fresh full backup appears regularly — speeding up restores and shortening the critical incremental chain. Use case: all current enterprise backup suites (Veeam, Veritas NetBackup, Acronis) ship with this. Requires fast backup storage — a capable NAS or dedicated storage server. Software details follow in part 6. |
SnapshotSECONDS-CAPTURE MINIMAL OVERHEAD NOT A BACKUP REPLACEMENT A snapshot is a consistent point-in-time view of a volume or VM, created by the file system or hypervisor itself (ZFS, btrfs, LVM, VMware, Hyper-V, Synology BTRFS snapshots etc.). Creation and rollback take seconds because internally only block pointers are copied (Copy-on-Write). This delivers extremely low RPO — snapshots every 15 minutes are easy. Important: a snapshot lives on the same storage as the source — if the underlying disks fail, both are gone. Snapshots are not backups under the 3-2-1 rule but a complementary tool for short-term rollbacks (accidentally deleted file, failed migration, test rerun). Best practice: use snapshots as “first line of defence”, run a classic backup on separate media in parallel. Many backup suites can use snapshots as source — this yields consistent, application-quiesced backups without production load. |
CDP — Continuous Data ProtectionRPO NEAR ZERO STORAGE & LICENSE INTENSIVE Continuous Data Protection logs every write in real time, similar to a database log. Rollback to any past point in time becomes possible — second- or millisecond-accurate. RPO near zero, RTO in seconds. Cost: significant performance overhead at the source and high storage demand for the journal. Classic use: high-availability databases, trading systems, regulated workloads. Notable implementations: Zerto, Veeam CDP, DataCore. |
Image vs file-level backup
Orthogonal to all the above is the question at which level the backup operates:
Image backup (block level)Captures the entire disk image — boot sector, partitions, filesystem, contents. Enables bare-metal recovery (full server rebuild on new hardware). Pro: fastest full system restore. |
File-level backupCaptures individual files and directories. Allows targeted recovery of single objects without a full system restore. Pro: granular restore (e.g. one accidentally deleted Excel file). |
Best practice: combine both. Modern backup suites can extract individual files from an image backup (“item-level restore” or “granular recovery”) — combining both advantages in a single job. Standard for VMs today.
GFS scheme (Grandfather-Father-Son)
Whichever method is used — eventually the question becomes how many backups are kept for how long. Since the 1990s the GFS scheme has prevailed: Grandfather-Father-Son, three generations with different retention periods.
| Son daily | Daily backups, usually incremental or differential. Typical retention: 7–14 days. Protects against short-term errors, accidental deletion, broken updates. |
| Father weekly | Weekly full backups, usually on the weekend. Typical retention: 4–8 weeks. Protects against medium-term errors, late-discovered corruption. |
| Grandfather monthly/yearly | Monthly or yearly full backups, often on tape cartridges and stored offsite. Retention: months to years — for tax-relevant data per HGB/AO 10 years, personnel records up to 30. |
A concrete GFS configuration for a typical mid-sized company might look like:
Practically every professional backup suite ships with pre-built GFS schemes — just parameterise with your retention values. Still worth the one-off reflection: which data really needs 10 years? Where does short-term snapshot suffice? More in part 7 (best practices & compliance).
Frequently asked questions
Incremental or differential — which is better?
Neither is “better” — it is a trade-off. Incremental is faster on backup but slower and more fragile on restore. Differential is simpler on restore but costs more storage every day. For modern setups with synthetic consolidation, incremental is almost always the right choice — the backup software (Veeam, Acronis & co.) handles the rest.
Are snapshots a backup?
No. A snapshot lives on the same storage as the source — a hardware failure of the underlying RAID disks takes both with it. Snapshots are a tool for short-term rollbacks (accidentally deleted file, failed migration), never a substitute for a real backup under the 3-2-1 rule.
How often should a full backup run?
Rule of thumb: at least weekly, ideally on the weekend with sufficient runtime. For smaller volumes (< 500 GB) daily is also fine. For very large data (> 5 TB) and incremental methods, monthly fulls suffice if synthetic consolidation runs in between.
What is a “Forever Incremental” strategy?
A modern variant where one full is taken initially and after that only incrementals run. The backup software consolidates incrementals into synthetic fulls in the background. Advantage: minimal backup footprint at the source. Requirement: a capable backup repository (ideally with deduplication).
When does tape still make sense vs NAS or cloud?
Tape is by far the cheapest storage technology per TB for long-term archives (beyond 5 years) — and through physical eject of the cartridge a natural air-gap against ransomware. For short-term backups (daily/weekly), NAS is faster and more flexible. Detailed discussion in part 3 (Local backup media).
Important: a method is not a strategy. Only the combination of method (this part), medium (part 3), location (parts 4 and 5) and software (part 6) builds a working backup solution. And without documented restore tests (part 7), even the best architecture has no real value.
Consulting on backup methods and softwarePlanning to choose or update your backup solution? We help with method choice (full vs incremental vs synthetic), hardware sizing for NAS and tape subsystems and selection of the right backup software. Phone: +49 (0)7666 / 88499-0 · E-mail: sales@industry-electronics.com |
Related shop categories
| Backup softwareBackup solutions Data protection |
Backup targetsStorage NAS · Storage SAN Storage server Direct Attached Storage |
Tape & cartridgeBand/Cartridge Tape array · RDX |
| Servers & controllersServers · Rack-mount RAID controllers |
Hard disks & SSDHard disks SSD SATA · SSD M.2 |
Caddies & storageDrive caddies Storage media |
Other parts of this series
|
You are here: Part 2 — Backup Methods |
Last updated: April 2026 · Lieske Elektronik · industry-electronics.com