Backup and Recovery

Why back up

A backup is a copy of data, kept separately from the original, from which you can restore that data after it is lost or damaged. "Separately" is the important word: a copy on the same disk, in the same building or reachable by the same malware shares the fate of the original. Data gets lost in several ways, and a good backup plan covers all of them:

• Hardware failure. Drives wear out and fail, sometimes without warning; so do controllers and whole laptops.
• Deletion and overwriting. The most common cause in a help desk queue: a user deletes a folder, saves over a report or empties the Recycle Bin.
• Ransomware. Malicious software encrypts files and demands payment for the key. It encrypts everything it can reach, including mapped network drives and connected backup disks.
• Theft and loss. A stolen laptop takes its only copy of the data with it.
• Disaster. Fire, flooding or a power surge can destroy every device in a building at once.

A redundant array of independent disks (RAID) protects against one of these, a failing drive, and against none of the others: a deleted file is deleted on every mirror at the same moment. See RAID is not a backup.

What to back up

Not everything on a computer is equally valuable, or equally hard to get back. Technicians usually think in three layers:

• Data: documents, photos, mailboxes, databases, project files. Often irreplaceable, and the first priority.
• System image: a copy of a whole drive, with the operating system, installed programs and settings. It restores a working computer in one step, instead of reinstalling everything.
• Configuration: settings that took time to get right, such as application settings, browser profiles, server and network device configurations, license keys and a list of installed software.

In organizations, the operating system itself is often not backed up per computer: a standard image is redeployed and the user's data comes back from the server or cloud. On servers, a full system backup is usual because rebuilding by hand takes too long.

Full, incremental and differential backups

Copying everything every night is simple but slow and uses a lot of storage. Most backup schedules therefore combine one occasional complete backup with smaller backups of what changed in between.

Full backup

A full backup copies every selected file, whether it changed or not. It is the easiest to restore — one set contains everything — but it takes the longest and uses the most storage. Every other backup type starts from a full backup.

How changes are tracked: the archive bit

To copy only what changed, the backup software must know which files changed. The classic Windows mechanism is the archive bit, a file attribute (shown as A by the attrib command). Windows sets it whenever a file is created or modified; backup software can clear it after copying the file. Current backup software mostly uses file timestamps, the change journal of NTFS (New Technology File System) or block-level change tracking instead, but the logic is the same: "changed since which backup?"

Incremental backup

An incremental backup copies only the files that changed since the previous backup of any type, and then marks them as backed up (clears the archive bit). Each incremental is small and fast. The price is paid at restore time: you need the last full backup plus every incremental since then, restored in order. If one link in that chain is missing or damaged, everything after it is lost.

Differential backup

A differential backup copies every file that changed since the last full backup, and does not mark the files as backed up (leaves the archive bit set). So each differential contains everything its predecessors did, plus that day's changes: it grows every day until the next full backup. A restore needs only two sets: the last full backup and the latest differential.

Synthetic full backup

A synthetic full backup is built on the backup server by merging the last full backup with the incrementals that followed it. The result is a new full backup, made without reading everything from the source computer again. It keeps restores short while the source only ever sends incrementals, which is why many current backup products work this way.

The types compared

A typical schedule makes a full backup on Sunday and a smaller backup every other night. The difference between the schemes shows up in backup time, storage and restore steps:

Working out the restore sets

The restore rule is mechanical, so it is easy to compute. The program below lists which sets a technician needs to restore the state at the end of a given day, for both schemes:

DAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"]


def restore_sets(scheme, day):
    """Backup sets needed to restore the state at the end of `day`.
    A full backup runs on Sunday; the other days use `scheme`."""
    position = DAYS.index(day)
    if position == 0:
        return ["Full Sun"]
    if scheme == "incremental":
        return ["Full Sun"] + [f"Inc {d}" for d in DAYS[1 : position + 1]]
    return ["Full Sun", f"Diff {day}"]


for day in ["Sun", "Tue", "Fri", "Sat"]:
    print(day)
    for scheme in ["incremental", "differential"]:
        sets = restore_sets(scheme, day)
        print(f"  {scheme:<12} {len(sets)} sets: {', '.join(sets)}")

Sun
  incremental  1 sets: Full Sun
  differential 1 sets: Full Sun
Tue
  incremental  3 sets: Full Sun, Inc Mon, Inc Tue
  differential 2 sets: Full Sun, Diff Tue
Fri
  incremental  6 sets: Full Sun, Inc Mon, Inc Tue, Inc Wed, Inc Thu, Inc Fri
  differential 2 sets: Full Sun, Diff Fri
Sat
  incremental  7 sets: Full Sun, Inc Mon, Inc Tue, Inc Wed, Inc Thu, Inc Fri, Inc Sat
  differential 2 sets: Full Sun, Diff Sat

The storage side is the mirror image. Suppose the full backup is 500 GB and users change a different 20 GB every day. Each incremental then holds 20 GB, while each differential holds everything since Sunday:

FULL_GB = 500
CHANGED_PER_DAY_GB = 20
WEEKDAYS = ["Mon", "Tue", "Wed", "Thu", "Fri", "Sat"]

totals = {"incremental": FULL_GB, "differential": FULL_GB}
print("Day  Incremental  Differential")
for number, day in enumerate(WEEKDAYS, start=1):
    incremental = CHANGED_PER_DAY_GB
    differential = CHANGED_PER_DAY_GB * number
    totals["incremental"] += incremental
    totals["differential"] += differential
    print(f"{day}  {incremental:>8} GB  {differential:>9} GB")

for scheme, total in totals.items():
    print(f"Week total, {scheme}: {total} GB")

Day  Incremental  Differential
Mon        20 GB         20 GB
Tue        20 GB         40 GB
Wed        20 GB         60 GB
Thu        20 GB         80 GB
Fri        20 GB        100 GB
Sat        20 GB        120 GB
Week total, incremental: 620 GB
Week total, differential: 920 GB

The 3-2-1 rule and retention

The 3-2-1 backup rule is a simple test for whether data is really safe:

• 3 copies of the data: the original plus two backups.
• 2 different media or storage types, such as an internal disk and a backup appliance, a network share and tape, or a local disk and cloud storage. One fault or one kind of failure should not reach both.
• 1 copy offsite, in another building or in the cloud, so a fire or theft does not take everything.

Because ransomware deliberately searches for backups, many organizations now extend this to 3-2-1-1-0: one copy is offline, air-gapped or immutable (it cannot be changed or deleted for a set period, even by an administrator), and restores are verified with zero errors.

Retention and versioning

Retention is how long backups are kept before they are deleted or overwritten. It matters because problems are often found late: if a spreadsheet was corrupted three weeks ago and the oldest backup is two weeks old, every copy is already corrupt. Keeping several versions of each file lets you go back to a point before the damage.

Keeping every daily backup forever is too expensive, so rotation schemes thin them out. The best-known is grandfather-father-son (GFS): daily backups (sons) kept for a week or two, weekly backups (fathers) kept for a month or so, and monthly backups (grandfathers) kept for a year or longer. Retention for business records is often set by law or policy, not only by the technician.

RPO, RTO and testing restores

Two numbers turn "we need backups" into a concrete design. They are agreed with the business, not chosen by the technician.

• The recovery point objective (RPO) is the maximum amount of data, measured in time, that may be lost. An RPO of 24 hours allows a nightly backup; an RPO of 15 minutes requires backups or replication at least every 15 minutes.
• The recovery time objective (RTO) is the maximum time a system may be down before it must work again. It decides whether restoring from a cloud backup over the internet is fast enough, or whether a local copy or a standby system is needed.

An example: an accounting firm backs up its file server every night at 23:00, and a disk controller dies at 16:00 the next day. Up to 17 hours of work are lost, which fits an RPO of 24 hours but not one of 4 hours. If restoring 2 TB from the cloud takes 20 hours while the RTO is 8 hours, the plan fails even though the backup itself is perfect.

Testing restores

Backups fail silently: a job that stopped months ago, a backup that skips open files, an encryption key nobody wrote down, media that can no longer be read. The only proof that a backup works is a restore. Good practice:

• Check the backup job reports daily, and act on warnings — not only on failures.
• Restore sample files regularly, to a different location so the originals are not overwritten, and open them.
• Periodically restore a whole system, preferably to spare hardware or a virtual machine, and time it against the RTO.
• Document the restore procedure, including where encryption keys and passwords for the backup are kept.

Backup and restore tools in Windows

Windows has several built-in tools. They overlap, and each protects something different, which is a common source of confusion.

File History

File History automatically copies personal files — the libraries (Documents, Pictures, Music, Videos), the Desktop and a few other user folders — to an external drive or a network location, by default every hour. It keeps older versions, so a user can restore yesterday's version of a document. In Windows 11 it is set up through Control Panel (File History); in File Explorer, a file's Properties can show its previous versions. It does not back up programs or Windows itself.

The Windows Backup app

Windows 11 includes the Windows Backup app. It backs up selected user folders to OneDrive and remembers settings, credentials and the list of installed apps in the Microsoft account, so that a new or reset PC can be set up with them. It is designed to move a user to a new PC; it is not a system image, and because the folders go to OneDrive, the limitations of sync described below apply.

System Restore and restore points

A restore point is a snapshot of Windows system files, installed programs, drivers and the registry that System Restore can return the computer to. Windows creates restore points automatically before events such as installing updates or drivers, when System Protection is turned on for the drive; you can also create one manually. Restoring undoes system changes made after that point, which makes it the right tool after a bad driver or program installation.

What System Restore does not do:

• It does not back up or restore personal files. Documents deleted after the restore point stay deleted, and documents created after it are kept.
• It does not protect against disk failure: restore points live on the same drive.
• It is not a defense against ransomware; malware can delete restore points.
• It only works if System Protection was on before the problem. On many computers it is off for the system drive; check under System Properties → System Protection.

rstrui opens System Restore. In Windows PowerShell (5.1, run as administrator) you can create and list restore points; Windows creates at most one restore point per 24 hours through this cmdlet by default:

Checkpoint-Computer -Description "Before printer driver update" -RestorePointType DEVICE_DRIVER_INSTALL
Get-ComputerRestorePoint

CreationTime           Description                    SequenceNumber    EventType         RestorePointType
------------           -----------                    --------------    ---------         ----------------
9/24/2026 9:02:41 AM   Installed Contoso PDF Tools    37                BEGIN_SYSTEM_C... APPLICATION_INSTALL
10/1/2026 2:15:08 PM   Before printer driver update   38                BEGIN_SYSTEM_C... DEVICE_DRIVER_INSTALL

System image (legacy)

Backup and Restore (Windows 7) in Control Panel can still create a system image, a copy of the whole system drive that System Image Recovery in the recovery environment can restore. Microsoft has deprecated it and no longer develops it; it remains available at the time of writing, but organizations use third-party or enterprise backup software for images, and many simply reimage computers and restore data from the server.

Copying with robocopy

Technicians often copy a user's data before a repair with robocopy. It is fast and restartable, but know what the switches do:

robocopy C:\Users\ana\Documents E:\Copy\ana\Documents /E /R:1 /W:1

/E copies all subfolders, including empty ones; /R:1 /W:1 retries a locked file once after one second instead of the default million retries at 30-second intervals. /MIR (mirror) is different: it makes the destination an exact copy of the source, which means it deletes files in the destination that are not in the source. With the source and destination swapped by mistake, or with a source that was just emptied, /MIR destroys the copy. A mirror is a synchronization, not a versioned backup.

Time Machine and cloud services

macOS Time Machine

On a Mac, Time Machine automatically backs up all your files, apps and settings to an external drive or a network location: hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all previous months, deleting the oldest when the disk is full. You can restore single files, or the whole Mac from macOS Recovery. The sealed system volume, which holds macOS itself, is not backed up: a full restore reinstalls macOS and then restores your data. Turn on Encrypt backups when you choose the backup disk, so a lost or stolen backup drive does not expose the data. See macOS Essentials.

Cloud backup versus cloud sync

A cloud backup service copies data to the provider on a schedule and keeps versions under its own retention policy, separate from the computer. A sync service such as OneDrive, iCloud Drive, Google Drive or Dropbox keeps the same files identical on every device. Sync is excellent for access and collaboration, but it is not a backup: when a file is deleted, overwritten or encrypted by ransomware on one device, sync faithfully copies that change everywhere.

Most sync services do keep a recycle bin and some version history for a limited time, and OneDrive can restore a whole folder to an earlier point within its retention window. That helps, but the retention is set by the provider, and the data still has a single owner account that can be compromised. Treat it as a convenience, and keep a real backup as well.

Recovery environments

When the operating system itself no longer starts, recovery tools must run from somewhere else. Both Windows and macOS include a small separate environment for that.

Windows Recovery Environment

The Windows Recovery Environment (WinRE) starts automatically after repeated failed boots, or on demand: hold Shift while choosing Restart, or use Settings → System → Recovery → Advanced startup. It can also start from Windows installation media. Under Troubleshoot it offers Reset this PC, which reinstalls Windows, keeping or removing personal files. The other tools are under Troubleshoot → Advanced options:

• Startup Repair: automatic repair of common boot problems.
• System Restore: return to a restore point without starting Windows.
• Uninstall Updates: remove the latest quality or feature update.
• System Image Recovery: restore a system image.
• Command Prompt, Startup Settings (for safe mode) and UEFI Firmware Settings.

How to use these to repair a computer is covered in OS Troubleshooting.

macOS Recovery

macOS Recovery runs from a hidden part of the startup disk, or over the internet if that is damaged. On a Mac with Apple silicon, shut down and hold the power button until the startup options appear, then choose Options; on an Intel-based Mac, hold Command-R while it starts. It offers Restore from Time Machine, Reinstall macOS, Disk Utility, Safari for looking up help, and Terminal under the Utilities menu.