Please Read: Significant Update Planned, Migrating Forum Software This Month

See more
See less

Windows Server backup - location of differential files

  • Filter
  • Time
  • Show
Clear All
new posts

  • Windows Server backup - location of differential files

    We have been trying to figure out how Windows Server backup works, in particular, how it creates and stores its differentials. MS has little documentation in that regard. What we seem to think is the following:

    We do a first full backup to a USB on day 1. Let's assume it's 100 gig.

    Then on day 2 we do a 'fast' backup - which is a differential - all that has changed from day 1 - let's say it's 10 gig between new files created and others changed.

    Then on day 3 we do another 'fast' backup - this one will have all that changed from the base on day 1. Let's say on day 3 we did 20 gig of changes/adds.

    We do not see any files representing the 10 and 20 gig additions on the backup media but we know WSB must have put it there as we can recover to day 1, 2 or 3.

    So as it is not creating separate files our assumption is that it somehow adds the 30 gig to the original base image. So the image file representing the backup is increasing in size - it is as if Windows was adding 'volumes' with each backup and somehow keeping track of where those volumes are via the catalog.

    We would appreciate if someone were to go through our logic and comment - if someone actually has some MS material that would confirm or negate this that would be even better. Thanks in advance for any feedback.

  • #2
    You're assuming that each day only adds new files since the last backup, and that's not correct when discussing differentials. Differentials are backups which record everything changed since the last FULL backup. The backup system knows this because of a file object property called the 'Archive Bit'. When a full backup is taken, the archive bit is cleared. Every single file that is changed after that will have it's own archive bit checked, until either a full or an incremental backup is done. Differentials don't clear the archive bit. So if a full backup is taken on a Saturday, all files are copied and all archive bits are cleared (your 100GB example). The OS file system sets the archive bit for any file that's changed, so by Monday let's say there are 5.5GB worth of files that now have the archive bit set--that's how much data is backed up under a differential job definition. Now on Tuesday, another 4GB of files have changed, so their archive bits were set as well. Because the first day's 5.5GB of backed up files did not have their archive bits cleared, they're included in the Tuesday's differential, meaning a total of 9.5GB of files are backed up, still with their archive bits left as checked. This will continue until the next full backup job once more clears all the archive bits as it goes. So because each day's differential jobs copy a larger volume of data, each day's jobs will take a little longer. But with differentials, when you have to do a full restore for some reason, you only need the last full and the most recent differential, so the amount of restore effort taken is reduced. This whole process with the archive bits works differently with incremental backups, but a quick search for definitions about that will hilite those differences.

    The methodology I describe above is applicable to most backup software applications, not just Windows Backup.
    MSCA (2003/XP), Security+, CCNA

    ** Remember: credit where credit is due, and reputation points as appropriate **


    • #3
      Thanks for the detail. Actually there is just about zip from MS on this topic in any organized fashion. Windows Backup in all it's incarnations - desktop OS, server OS - has to be the world's mostly widely used backup software yet there is no Deep Dive from MS available anywhere. You have to comb through 'white papers' and tech notes and compile the Windows Server Backup guide yourself. My mouse comes with a 100 page manual.