4.7.1. Backup Methods and Media Types
💡 First Principle: Backup methods differ in what they copy and how they handle the archive bit (a flag that marks whether a file has been backed up). These differences determine backup job duration, storage consumed, and restore complexity—which directly maps to RTO achievement.
Backup Methods
| Method | What It Copies | Resets Archive Bit | Restore Requires |
|---|---|---|---|
| Full | Everything | Yes | Full backup only |
| Differential | Changed since last FULL | No | Full + last differential |
| Incremental | Changed since last backup (any type) | Yes | Full + every incremental since |
| Synthetic full | Combines full + incrementals at backup server | N/A | Synthetic full only (like full) |
| Archive | Files with archive bit set; removes from source | Yes | Archive job data |
| Open file (VSS) | Files open/in-use via Volume Shadow Copy Service | Varies | Depends on method |
| Snapshot | Point-in-time copy (not always a full backup) | N/A | Snapshot data |
Backup Frequency and Media Rotation
- Backup frequency: How often backups run. Determines the maximum RPO—if you back up nightly and a failure occurs just before the backup, you lose up to 24 hours of data.
- GFS (Grandfather-Father-Son) rotation: A classic media rotation scheme:
- Son (daily): Overwritten each week
- Father (weekly): Kept for a month
- Grandfather (monthly): Retained for a year or longer
Backup Media Types
| Media | Speed | Cost/GB | Durability | Use Case |
|---|---|---|---|---|
| Tape (LTO) | Fast sequential, very slow random access | Very low | Excellent (decades) | Long-term archival, off-site |
| Disk | Fast | Moderate | Good | Operational backup, fast restore |
| Cloud | Variable (network dependent) | Variable | Provider SLA | Off-site, disaster recovery |
| N/A | N/A | Paper lifespan | Specific configurations, not data |
File-level vs. System-state backups
- File-level backup: Backs up specific files and directories. Fast and targeted but doesn't capture OS state, registry, system files.
- System-state backup: Captures the OS, registry, boot files, and Active Directory (on domain controllers). Required for full server recovery. On DCs, system-state backup includes the AD database and SYSVOL—critical for AD restoration.
⚠️ Exam Trap: Incremental backups have the fastest backup time and smallest storage footprint—but the LONGEST restore time (must restore full + every incremental). Differential has longer backup time than incremental but faster restore. Full has the longest backup time but fastest restore. The exam presents this as a trade-off scenario.
Reflection Question: An organization needs to minimize recovery time after a server failure. Backup storage is not a concern. Which backup strategy (full, incremental, or differential) minimizes restore time, and what is the trade-off?
