What type of backup involves copying all files that have been changed since the last full backup?

A.  Full Backup

B.  Differential Backup

C.  Incremental Backup

D.  Mirror Backup

Correct Answer:  B

Explanation:
A. Full Backup
A full backup is the foundation of all backup strategies. It involves copying every file within the specified scope, regardless of whether the data has changed.

Archive Bit: During a full backup, the Archive Bit (a file attribute used to track changes) is cleared (set to 0) for every file.

Restoration: This is the simplest and fastest method to restore data because only one backup set is required. However, it is the slowest to perform and consumes the most storage media.

B. Differential Backup
A differential backup acts as a "cumulative" record of changes. It backs up all files that have been modified since the last full backup.

Archive Bit: Crucially, a differential backup does not clear the archive bit. Because the bit remains set, the next differential backup will again back up those same files, plus any new ones that changed in the meantime.

Why it's the Answer: The data grows larger each day until the next full backup is performed. To restore, you only need two pieces: the last full backup and the most recent differential backup.

C. Incremental Backup
An incremental backup only copies files that have changed since the most recent backup of any kind (full or incremental).

Archive Bit: Unlike the differential method, the incremental backup clears the archive bit. This "resets" the marker, so the next incremental backup only catches the changes made since that specific increment.

Comparison: While incremental backups are the fastest to perform and use the least storage, they are the most complex to restore. You must have the last full backup plus every single incremental backup in the exact chronological order.

D. Mirror Backup
A mirror backup is a real-time (or near real-time) exact replica of the source data.

• The Mechanism: It is often associated with technologies like RAID 1 or storage array replication. If a file is deleted from the source, it is immediately deleted from the mirror.
• The Risk: Unlike traditional backups, a mirror does not provide "versioning." If a file is corrupted or encrypted by ransomware, the mirror will immediately replicate that corruption, making it ineffective for recovering a "clean" previous version of the data.