4.4Backup and recovery (methods, RTO/RPO)

A backup is not an insurance policy of "keep one and relax"; it is the task of designing a method to meet the business requirements of "to which point in time you can roll back (RPO) and how fast you can recover (RTO)." Full, incremental, and differential each trade off the time and storage capacity at backup time against the complexity and time of the recovery procedure, and the choice shifts depending on whether you prioritize "the burden on the taking side" or "the speed on the restoring side." This section builds the judgment to accurately understand each method's recovery procedure and select a method by working backward from the recovery objectives RTO/RPO.

4.4.1Full, incremental, and differential backup

• A full backup copies all the target data every time. Its backup time and storage capacity are the largest, but recovery completes by restoring that single full backup alone—the fastest and simplest. An incremental backup copies only what changed since the previous backup (whether full or incremental). Each backup is the smallest and fastest, but recovery requires applying the latest full plus all subsequent incrementals in order, so the more incrementals there are, the longer and more complex recovery becomes, and it fails if even one in the chain is missing.
• A differential backup copies what changed since the latest full backup every time (always relative to the full, not the previous differential). Its backup time and capacity are larger than incremental and grow as differentials accumulate, but recovery needs only "the latest full plus the single latest differential"—faster, simpler, and more robust than incremental (two elements to apply, with lower risk of a broken chain). Incremental and differential sound alike, but the difference in reference point—incremental = since the previous backup, differential = since the latest full—is what separates their recovery procedures and robustness.

4.4.2Generation management and off-site storage

• Generation management is the practice of retaining multiple generations (e.g., the last 7 days, 4 weeks) rather than just one backup. With only the latest one, you cannot return to a normal state after a logical corruption (accidental deletion, ransomware encryption, data inconsistency) has already propagated into the backup. With multiple generations, you can go back to a generation from before the corruption occurred. The purpose of generation management is to prevent "the backup exists, but it was overwritten with corrupted data and cannot be restored."
• Off-site storage keeps backups geographically distant from the production system. Placing backups in the same building or data center as production means a fire, earthquake, or flood destroys production data and backups together. Off-site storage keeps the backup safe even if the production site is struck, so service continuity (ITSCM) holds. In recent years, replication to cloud storage is a common implementation of off-site storage.

4.4.3How backup methods correspond to RTO/RPO

• The RPO (tolerable data loss) is determined by the backup frequency. With a once-a-day backup, up to one day's data—from the pre-failure backup to the failure—is lost (RPO = 1 day). To shorten the RPO you must shorten the interval (e.g., hourly, or continuous synchronous replication), and raising the frequency increases the load and cost of taking backups.
• The RTO (speed of recovery) is determined by the backup method (simplicity of the recovery procedure) and the data volume. To recover fastest, a full backup (restore just one) is advantageous, while incremental tends to lengthen the RTO due to a long recovery chain. First fix the business requirements RTO/RPO as numbers, then work backward: derive the backup frequency from the RPO and the method (full-leaning or incremental-tolerant) from the RTO. If both are hard to satisfy, combine full plus incremental/differential (e.g., weekly full plus daily incremental) to strike a balance.

Suppose the service manager of a core business system is redesigning its backup method. Sorting out the business requirements shows that the recovery point must be at most 1 hour before the failure (RPO = 1 hour) and recovery must complete within 2 hours of the failure (RTO = 2 hours). The current setup is "only a once-a-day overnight full backup," which makes the RPO up to one day and utterly fails the 1-hour requirement. To meet the RPO, the frequency must be raised to hourly. Deciding to "take an hourly full backup" is impractical, because full backups have a large load and capacity and running an hourly full during business hours would strangle production performance. So the choice is a configuration that takes a full weekly (or daily) and takes hourly incremental or differential backups. Next, examining a recovery procedure that meets the RTO (within 2 hours): the incremental method means "the latest full plus all subsequent incrementals applied in sequence," and if up to 24 hourly incrementals accumulate in a day, the long recovery chain risks exceeding the RTO. The differential method, by contrast, recovers with just "the latest full plus a single latest differential"—two elements to apply, fast and robust—making the 2-hour RTO easier to meet. The trap here is the misconception that "incremental and differential are much the same"; in reality their recovery procedures differ fundamentally, and that is what determines whether the RTO requirement can be met. Further, off-site storage (cloud replication) secures the backup even in a disaster, and generation management makes it possible to go back to a generation from before a logical corruption (e.g., ransomware encryption). A service manager designs in this order: fix the business requirements RTO/RPO as numbers, derive the backup frequency from the RPO, and derive the method (such as adopting differential) from the RTO. The point is to work backward from requirements, not to start from a method.

4.4.4Section summary

• Full is fastest to recover and heaviest to take; incremental is lightest to take with a long recovery chain; differential is relative to the latest full, recovering with the full plus a single latest differential
• Generation management addresses logical corruption (accidental deletion, ransomware); off-site storage addresses disaster—different purposes
• The RPO is set by backup frequency and the RTO by the method (simplicity of the recovery procedure)—select the method by working backward from business requirements