4.7.1. Backup Methods and Media Types
💡 First Principle: Backup methods differ in what they copy and how they handle the archive bit (a flag that marks whether a file has been backed up). These differences determine backup job duration, storage consumed, and restore complexity—which directly maps to RTO achievement.
Backup Methods
| Method | What It Copies | Resets Archive Bit | Restore Requires |
|---|---|---|---|
| Full | Everything | Yes | Full backup only |
| Differential | Changed since last FULL | No | Full + last differential |
| Incremental | Changed since last backup (any type) | Yes | Full + every incremental since |
| Synthetic full | Combines full + incrementals at backup server | N/A | Synthetic full only (like full) |
| Archive | Files with archive bit set; removes from source | Yes | Archive job data |
| Open file (VSS) | Files open/in-use via Volume Shadow Copy Service | Varies | Depends on method |
| Snapshot | Point-in-time copy (not always a full backup) | N/A | Snapshot data |
Backup Frequency and Media Rotation
- Backup frequency: How often backups run. Determines the maximum RPO—if you back up nightly and a failure occurs just before the backup, you lose up to 24 hours of data.
- GFS (Grandfather-Father-Son) rotation: A classic media rotation scheme:
- Son (daily): Overwritten each week
- Father (weekly): Kept for a month
- Grandfather (monthly): Retained for a year or longer
- 3-2-1 rule and isolation: Keep 3 copies of data on 2 different media, with 1 copy off-site. Keep at least one copy offline (air-gapped) or immutable, because ransomware encrypts any backup target it can reach over the network.
- Reducing backup storage: Copy less per run (incremental jobs) and write to a deduplicating, compressing backup target (see 3.5.1), which stores each unique block only once. Controls that protect or check backups, such as encryption and verification, do not make them smaller.
Backup Media Types
| Media | Speed | Cost/GB | Durability | Use Case |
|---|---|---|---|---|
| Tape (LTO) | Fast sequential, very slow random access | Very low | Excellent (decades) | Long-term archival, off-site |
| Disk | Fast | Moderate | Good | Operational backup, fast restore |
| Cloud | Variable (network dependent) | Variable; archive/cold tiers are very low, with slow, fee-based retrieval | Provider SLA | Off-site, disaster recovery, long-term archive (archive tiers) |
| N/A | N/A | Paper lifespan | Specific configurations, not data |
File-level vs. System-state backups
- File-level backup: Backs up specific files and directories. Fast and targeted but doesn't capture OS state, registry, system files.
- System-state backup: Captures the OS, registry, boot files, and Active Directory (on domain controllers). Required for full server recovery. On DCs, system-state backup includes the AD database and SYSVOL—critical for AD restoration.
⚠️ Exam Trap: Incremental backups have the fastest backup time and smallest storage footprint—but the LONGEST restore time (must restore full + every incremental). Differential has longer backup time than incremental but faster restore. Full has the longest backup time but fastest restore. The exam presents this as a trade-off scenario.
Reflection Question: An organization needs to minimize recovery time after a server failure. Backup storage is not a concern. Which backup strategy (full, incremental, or differential) minimizes restore time, and what is the trade-off?
