Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » Incremental and full backups

Messages: 116

Karma: 0
Send a private message to this user
I ran into a situation this past week and I want to make sure that I understand how the automated backups work. Currently, I have a full backup scheduled Sunday mornings and incremental backups for each of the remaining days of the week.

I had a client who's accidentally removed a bunch of their messages (I think they may have been archived or pulled from the server via POP) about Tuesday last week. They were going to search for the messages on their end, but did not notify me until this Sunday afternoon that they needed me to restore their mailbox from our backup set. What I discovered was that I had my full backup set from the previous Sunday and I had a full backup set from yesterday, but no incremental backups in between the two full backups.

What I would like to know is what happened to the incremental backups. According the manual, the latest incremental backup will replace the previous incremental backup so that all we really need is the latest full backup and the latest incremental backup. However, it appears that the lastest full backup also replaces any incremental backups done throughout the week.

My concern is that the full backup done yesterday did not contain the missing items that this client removed. I am wanting to know what happened to the data from the incremental backups done throughout the week. Were they added to the full backup done yesterday? Or did the full backup only include a snapshot of the mailstore as of yesterday morning? Did the incremental backups get merged into the backup performed last Sunday? If this is the case, then that would be ok and actually would be preferable in my case. However, if the incremental backups were replaced by yesterdays full backup, then I can see a serious flaw in the way our automated backup system works.

One of my techs made a point to say that under this last scenario, if something blows up on a late Friday (at that time we would have incremental backups throughout the week and the lastest being early Friday morning), but isn't discovered until Monday morning when someone came into the office, then by that time the Sunday full backup would have taken place replacing all the incremental backups. That means that the most recent good backup set would be a week old!

Does anyone has any ideas or can explain what happened to my incremental backups in my above situation? Does anyone have any suggestions on how to prevent something like my last scenario from happening (aside from creating a manually copy of the incremental backups)?

Thank you.

Preferred Kerio Partner and Cloud Solutions Provider - Offering both shared and dedicated Kerio Connect hosting solutions.
Visit us at

Messages: 159
Karma: 0
Send a private message to this user
Terms: An incremental only has what has changed since the last backup. (Not the last "full" backup.) To completely recover, you need the last full backup and all incremental since it. A decremental includes everything that has changed since the last full backup. Sometimes this is controlled by reseting the archive bit. Incremental resets it on full and each incremental. Decremental only resets it on the full.

Anyway, if you are running Windows 2003, you can turn on VSS and allocate enough disk space to it. We have done this. We can go into anyone's mail folder and see many prior versions from which we can recover from. While your normal Kerio backup is great for DR recovery, the VSS is excellent for recovering a few odd lost files here and there since it updates very often. You can setup Windows tasks to do this on a schedule.

Pavel Dobry (Kerio)

Messages: 5245
Karma: 251
Send a private message to this user
KMS can make full or differential backup (changes since last full backup). Old differential backups are removed after new one is created. So, on Sunday you will get full full backup from last Sunday with last diff. backup from Saturday night and new full backup from Sunday.

If someone has deleted some emails on Tuesday, the emails are in last full backup but last differential backup file contains info that these emails should be removed on recovery (because they already don't exist in the store at the time when the differential backup was created). New full backup will not contain them as the files are no longer in the message store.
Previous Topic: 4.4.2 No greeting from Host
Next Topic: DOES KMS 6.5 support SSL in tls authentication enforcing
Goto Forum:

Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Wed Nov 22 12:19:35 CET 2017

Total time taken to generate the page: 0.00348 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.