First published on TECHNET on Mar 06, 2007
We’ve seen a number of customers ask why their incremental backups are almost as large as their full backup. This can be surprising on a lightly used system where you don’t change or add a lot of files between backups. Seeing files backed up that you know you didn’t change can be perplexing, but there is a good explanation: the files were indeed changed, either by a program or a perhaps inadvertently by a person. For example, any of the following actions can cause files to be changed and therefore backed up:
-
Antivirus programs writing to alternate streams on the files or programs that update media file metadata (ID3 tags, for example). Even right-clicking a file and viewing its properties can add an alternate data stream to the file, thus changing it.
-
Changing permissions on the parent folder or setting compression.
-
Moving the files to a different folder.
Backup in Vista does not make any decisions about which types of changes to back up versus those to ignore--any file that is changed will be backed up. To determine if a file has changed, Backup looks at creation date, modification date, and last written to date (visible only programmatically). Backup does not understand any file formats and does not look in any headers to decide when to back up a file, nor does Backup use the archive bit.
--Jill
