Symptoms

Acronis Cyber Protect may add an amount of information to incremental disk backup that exceeds the size of files that changes daily.

For example, the end-user may have spent an entire day working on a document 100 KB in size and noticed that daily backup added to archive 1-2 GB (numbers are provided as an example).  

Cause

This behavior is by design.

This happens due to the nature of disk backup and the design of Windows itself. In fact, Windows performs various activities on the hard drive that are not easily visible to end-users, but backup takes those changes into account.

The entire machine backup plan treats the entire drive as a disk with "raw" data. This means, it reads information from disk sectors and adds it to the archive (as opposed to file/folders backup plan that reads files). In order to add just valuable information agent uses special windows driver that tracks changes on the hard drive and instructs the backup agent to add to archive just sectors that were changed since the last backup.

There are some important considerations that should be taken into account:

• File/Folder deletions
• Volume Tracker driver uses 64kb block size. Thus in case of change of many small files, the overall amount of changes will exceed the total size of changes
• Background drive optimization that the driver also tracks: from a file system perspective you cannot see changes, but some data will be moved on disk sectors level
• VSS snapshots

Solution

The Entire Machine type of backup has some benefits (for example if the server is unbootable, it is possible to recover it and restore its bootability) but this comes with a price of additional information, stored in the archive. If you do not want this option, you may consider using a backup plan in File/Folders mode. This way you can backup up just the files instead of the entire drive.