8.3 Backup Types, Schedules, and the 3-2-1 Rule
Full, Incremental, Differential
A full backup copies everything; it is the anchor every other scheme trades against. An incremental backup captures only changes since the last backup of any kind, so nightly runs are tiny, but restoring requires the last full plus every later incremental replayed in order -- one corrupt link breaks the whole chain. A differential captures changes since the last full: each run is bigger than an incremental, yet restore needs just the last full plus the latest differential. Synthetic or active-full jobs periodically reassemble chains into a fresh full to cap restore depth. Deduplication and compression ride underneath all three, shrinking each generation while keeping restore points logically independent.
Schedules and Objectives
Backup cadence is set by the Recovery Point Objective (RPO), the data loss you tolerate measured backward from the disaster. Nightly incrementals bound loss to a day; database transaction-log shipping pushes the RPO to minutes. Layer retention with grandfather-father-son: daily increments, weekly father fulls, monthly grandfather archives kept far longer -- recent points dense, old points sparse. The sibling metric, Recovery Time Objective (RTO), shapes the restore path: long incremental chains lengthen recovery, which is the hidden cost of cheap backups.
The 3-2-1 Topology
The classic rule: keep at least 3 copies of data, on at least 2 distinct media types, with at least 1 copy off-site. The original plus two backups means a single failed drive plus a failed archive is still survivable; two media families (say NVMe/NAS disk and tape or cloud object storage) means a defect or firmware bug in one technology does not hit both; the off-site copy survives fire, flood, theft, and a site-wide credential compromise that co-located copies share.
Offline and Immutable Copies
Ransomware crews enumerate network shares, cloud credentials, and backup catalogs first -- anything mounted or writable with stolen credentials is deletable. The modern extension, 3-2-1-1-0, adds one offline or immutable copy and zero errors via restore testing. Offline means physically air-gapped, like rotated tape; immutable means write-once retention enforced by the storage itself, such as S3 Object Lock in compliance mode or Azure immutable blob storage, where even an administrator cannot alter data until the retention period lapses. Versioning alone is not immutability if the same stolen key can disable it.
Architecture Diagram
Key Takeaways
- Increments are cheap to make but fragile to restore; differentials need only the last full plus the latest set.
- Set cadence by RPO and cap restore chains with periodic synthetic fulls.
- 3-2-1 means three copies, two media families, one offsite -- each clause defeats a different correlated failure.
- Upgrade to 3-2-1-1-0: one offline or WORM/object-lock copy, and zero errors proven by restore tests.
- Assume attackers hunt backups before encrypting production; network-writable copies are all exposed to one stolen key.