Automate incremental backups with Robocopy

Robocopy synchronizes changes after the first full copy, and with /MIR can reflect deletions.
Automation is possible with /MON, /MOT and /RH or with the Task Scheduler.
Switches such as /COPY, /Z, /MT, /XO and /LOG logs allow for optimization and auditing.
For versioning and recovery, it is advisable to complement with image copies (AOMEI).

If you work with Windows and want to keep your files safe without duplicating data like crazy, Robocopy It's an excellent option. This utility, incorporated since Windows Vista and Windows Server 2008, replaces Xcopy with more power. In this article we show you How to automate incremental backups with Robocopy and thus manage your files with peace of mind.

Copies made by Robocopy are incremental. La First run copies everything and subsequent runs only sync changes (and new files) to the destination. This is about state synchronization, not "versioning" with restore points; if you accidentally delete or overwrite something and replicate it, that change is transferred to the destination.

What is Robocopy and how does incrementality work?

Robocopy, from “Robust File Copy”, replicates the contents of a folder tree with granular control. On the first pass, it performs a full backup; on subsequent passes, it detects what has changed and synchronizes only what has changed. This strategy reduces time and bandwidth usage on a daily basis.

Important: Without the /MIR parameter, Robocopy does not delete by default on the destination what no longer exists in the source; with /MIR (or /PURGE) it does reflect deletions. It's very powerful for mirroring, but also more delicate if there are no copies with a history because the deleted items will be replicated.

The base syntax is very straightforward and allows you to add filters, modes, and performance controls: It is ideal for automating professional routines copy to servers, NAS or network shares.

Basic syntax and essential concepts

The general Robocopy command is: copy from a source to a destination with options to adjust the behavior. This is the canonical form:

robocopy <source> <destination> [<file>[ ...]] [<options>]

For example, to send a file from a local computer to a shared resource and take advantage of multithreading and restartable copy, you can use something like:

robocopy C:\reports "\\marketing\videos" yearly-report.mov /mt /z

In practice, “incrementals” are as simple as repeat the same sync command with the same source/destination pair; Robocopy detects and copies only new or modified items.

Quick Start Guide: Incremental Copy with Robocopy Step by Step

To see the workflow clearly, let's take an example between test folders: from the C:\test directory to D:\test.

Open CMD Using Win+R, type CMD and press OK. You can also search for “Command Prompt.” Working from the console allows you to see the live log..
Launch the first synchronization (first full pass): robocopy C:\test D:\test. After this execution, In the destination you will have the mirror of the origin. On subsequent runs, only what has been changed or added will be copied.
Add useful switches To refine the incremental: for example, include subfolders, skip older files, allow resume, and avoid percentages on the screen:robocopy C:\test D:\test /s /xo /z /np

Some common ideas: /mir to reflect erasures and voids, /xo so as not to overwrite with old versions, /z to resume in cuts and /np for a cleaner exit.

Automation: Monitoring Parameters and Task Scheduler

If you want it to run automatically, You can program Robocopy in two ways: with your own reactive parameters or through the Windows Task Scheduler.

By parameters: Robocopy can monitor changes and repeat copies based on time or activity criteria. These are the key flags:

/MON:n reacts when it detects n changes in the source.
/MOT:m reruns if there are changes, checking every m minutes.
/RH:hhmm-hhmm limits the start times (for example, /RH:1700-1800).

Typical example, run every 10 minutes when there is new activity: monitors and synchronizes without intervention.

robocopy C:\test D:\test /mot:10

If you need to stop the task, You can end the process from another console with:

taskkill /f /im robocopy.exe

With Task Scheduler: Another way is to create a batch file (.bat) with the desired Robocopy command and schedule it. This way you ensure execution in specific time windows..

Open Notepad, paste your Robocopy command, and save as a .bat file (e.g., “incremental_robocopy.bat”).
Search for “Task Scheduler” and choose “Create Basic Task…”. Assign name and description.
Choose the trigger (Daily, Weekly, etc.) and the time.
Action “Start a program” and select your .bat with “Browse”.
Confirm and that's it: the task will appear in the Programmer's Library to run or delete it whenever you want.

Exclusive content - Click Here WireGuard made easy: create your own VPN in 15 minutes

Robocopy Essential Options and Switches

Robocopy stands out for its huge collection of flags. Below you have an ordered compendium so that you don't miss any and choose wisely.

Copy options

/s Copies subdirectories, except empty ones.
/e Copy subdirectories including empty ones.
/lev:n Limits copying to the first n levels of the tree.
/z Restartable mode (resumes interrupted copies).
/b Backup mode (ignores ACLs if they block access).
/zb Starts at /zy, if access is denied, changes to /b.
/j Unbuffered I/O (ideal for large files).
/efsraw Copy EFS encrypted files in raw mode.
/copy:flags Which metadata to copy: D (data), A (attributes), T (timestamps), X (ignore ADS), S (ACLs), O (owner), U (audit). The default is /COPY:DAT.
/dcopy:flags What to copy to directories: D, A, T, E (extended attr.), X (omit ADS). By default DA.
/sec Safe copy (equivalent to /copy:DATS).
/copyall Copy everything (equivalent to /copy:DATSOU).
/nocopy Does not copy metadata (useful with /purge).
/secfix Repairs security even on skipped files.
/timfix Corrects times even in skipped files.
/ purge Eliminate at destination what no longer exists at origin.
/mir Reflects tree (equivalent to /e + /purge).
/mov Move files (delete source after copying).
/move Move files and folders (and delete source).
/a+:[RASHCNET] Add attributes to the result.
/a-:[RASHCNETO] Removes attributes from the result.
/create Creates zero-length structure and files.
/fat 8.3 (FAT) names when creating on destination.
/256 Disable paths >256 characters.
/mon:n Repeat when >n changes are detected.
/mot:m Repeat in m minutes if there are changes.
/rh:hhmm-hhmm Window of hours allowed to start.
/pf Apply windows per file (not per pass).
/ipg:n Pause between packets (slow lines).
/sj Copy symbolic links as links (not as destinations).
/sl Don't follow links, copy the link itself.
/mt:n Multiprocessing with n threads (1-128, default 8). Not compatible with /ipg or /efsraw.
/nodcopy Does not copy directory metadata (default /dcopy:DA).
/nooffload Avoid downloading a copy of Windows.
/compress Request network compression if applicable.
/sparse:y|n Preserves scattered state (default yes).
/noclone It does not attempt block cloning as an optimization.

I/O Limiting (Throttling)

/iomaxsize:n[kmg] Maximum I/O per cycle.
/iorate:n[kmg] Desired I/O speed.
/threshold:n[kmg] Minimum size threshold to apply limitation.

These options set the maximum bandwidth that Robocopy can useIf you don't specify units, you can use K, M, or G. The minimum limit is 524288 bytes. /Threshold defines the starting size of the limit.

File selection

/a Only files with the File attribute.
/m Only files with Archive attribute and restart it.
/ia:[RASHCNETO] Include files that have the specified attributes.
/xa:[RASHCNETO] Exclude files with any of those attributes.
/xf name[ …] Exclude by name or path (wildcards * ? supported).
/xd directory[ …] Excludes directories by name or path.
/xc Excludes existing ones with the same timestamp but different sizes.
/xn Excludes if origin is newer than destination.
/xo Excludes if origin is older than destination.
/xx Excludes “extras” present at destination but not at origin (does not delete them).
/xl Excludes “solitary individuals” present at origin but not at destination (prevents adding new ones).
/im Includes “modified” files (different change times).
/es Includes “same” files (identical in all).
/Item Includes “retouched” (same name/size/times, different attributes).
/max:n Maximum size in bytes.
/min:n Minimum size in bytes.
/maxage:n Maximum age (in days or date) by last modification.
/minage:n Minimum age (in days or date) by last modification.
/maxlad:n Maximum last access date (excludes unused since n).
/minlad:n Minimum last access date (excluding those used since n). If n < 1900, days; otherwise, YYYYMMDD.
/xj Excludes junction points.
/fft FAT style timings (two-second accuracy).
/dst Adjusts daylight saving time (+1h).
/xjd Excludes directory junction points.
/xjf Excludes file junction points.

Exclusive content - Click Here How to Automatically Watermark Your Videos with AI

Retries and fault tolerance

/r:n Number of retries on failures (default 1.000.000).
/w:n Wait between retries in seconds (default 30).
/reg Save /r and /w as defaults in the Registry.
/tbd Wait for share names to be defined (error 67).
/lfsm “Low clearance” mode: pause to avoid going off the “ground”.
/lfsm:n[kmg] Set the floor explicitly (if not, 10% of the volume). Not compatible with /mt or /efsraw.

Check-in and check-out

/l List only (no copying, deleting, or marking times).
/x Report all extras, not just selected ones.
/v Verbose output with files omitted.
/ts Include source timestamps in the output.
/fp Displays full routes.
/bytes Sizes in bytes.
/ns /nc /nfl /ndl Do not log sizes, classes, file or directory names.
/np No numerical progress.
/eta Displays estimated time per file.
/log:file Records to file (overwrites).
/log+:file Record in file (attached).
/unilog:file Unicode record (overwrites).
/unilog+:file Unicode Registry (attached).
/tee Displays in console and logs at the same time.
/njh /njs Without header or summary of the work.
/unicode Displays output as Unicode text.

Job Management

/job:name Loads parameters from a saved job file.
/save:name Saves the current parameters as a job.
/ quit Exits after processing the line (to inspect parameters).
/nosd /nodd Indicates absence of origin or destination.
/if Force inclusion of specified files.

Practical engine notes

Use /MIR or /PURGE in root No longer affects “System Volume Information” – Robocopy now ignores it at higher levels.
La classification of modified files requires systems with change timestamps (NTFS); by default they are not copied unless you use / IM.
The brand /DCOPY:E Attempts to copy extended attributes of folders; if it fails, continue. It is not included in /COPYALL.
With /IoMaxSize o /IoRate You enable I/O limiting; Robocopy and the system can adjust allowed values as needed.
/LFSM sets a “floor” of free space (default 10% if you do not specify it). Cannot be combined with /MT or /EFSRAW.

aomei

Plan B with recoverable version: AOMEI Backupper

If you are concerned about reverting to previous versions, a solution with images and restoration fits better. AOMEI BACKUPPER STANDARD It is free and compatible with all modern editions of Windows.

Key features: Full and incremental backups between internal/external drives, USB, NAS, network and cloud; plus “clear” file synchronization if you prefer not to use images.

Image advantages: you can schedule incremental and return to a previous point with a click. Sync replicates files as is (similar to Robocopy) and can also be scheduled.

Higher editions (Professional) add real-time, bidirectional synchronization and differential copies, among other advanced features.

Summary steps for an incremental file task: Open the app and go to Backup > File Backup. Choose which folders or files to include; if they're coming from a network, use the Share/NAS option to specify the path.

Select the destination (local, removable, shared resource, or cloud). Configure the Schedule (daily, weekly, monthly; event triggers or when connecting USB in advanced editions) and Options (compression, splitting, comments, email, etc.).

If you need a retention strategy (automatically delete old backups and use differential backups), enable it in the Advanced settings. When you're ready, tap Start Backup.

KB5042421 incident and blue screens: what happened and how to recover

On July 19, 2024, a massive incident involving CrowdStrike occurred. caused BSOD on millions of Windows computersMicrosoft estimated 8,5 million devices were affected. Although recovery tools and fixes were released, the full cleanup took days.

If you were shocked, here you go recovery methods recommended, including removing the problematic driver and restoring a system. These steps may require the BitLocker recovery key on encrypted computers.

Method 1: Recover from WinPE with driver removal

Press and hold the power button for 10 seconds to turn off; turn it back on. We force a clean reboot.
At the login screen, hold Shift and select Power > Restart.
Under “Choose an option,” click Troubleshoot.
Go to Advanced Options > Startup Settings > Enable Safe Mode.
Reboot. The BitLocker key may be requested if your drive is encrypted.
When you reboot, press F4 for Safe Mode (on some devices, F11).
Once in safe mode, right-click Start > Run, type cmd, and then click OK.
If your system is not C:\, change it with C: and Enter. We need to go to the driver route.
Navigate to the CrowdStrike driver folder (adjust letter if different):
```
CD C:\Windows\System32\drivers\CrowdStrike
```
List files that match the faulty driver pattern:
```
dir C-00000291*.sys
```
Permanently deletes found:
```
del C-00000291*.sys
```
Manually check for any remaining matches and delete them. Restart your computer when finished.

Exclusive content - Click Here Reinstall Edge WebView2 when it crashes on desktop apps

Method 2: Recover from Safe Mode with BitLocker Key Collection

Reboot as in the previous method and go to Troubleshoot > Advanced options > Startup Settings > Enable Safe Mode. Use F4 or F11 depending on the device.
If the BitLocker prompt appears, on your mobile device, go to https://aka.ms/aadrecoverykey, sign in with your corporate account, and locate your key under Manage Devices > View BitLocker Keys > Show recovery key.
Select your device, view the key, and enter it into your computer.
Enter Safe Mode, open Run > cmd and navigate to the CrowdStrike folder:
```
CD C:\Windows\System32\drivers\CrowdStrike
```

Locate and delete the problematic file:

dir C-00000291*.sys
 del C-00000291*.sys

Check that there are no remains, and restart. This method avoids needing the key on some devices.

Method 3: Go back with System Restore

Boot into the recovery screen (Shift + Restart) and go to Troubleshoot > Advanced options > System Restore.
If BitLocker is requested, use the portal above to retrieve the key. Enter the key on the device.
Select a restore point, click Next and Finish, and confirm with Yes.

This process reverts system components, should not touch your personal data, and it may take about 15 minutes.

HTTPS, WebDAV, and open source alternatives

Robocopy shines with SMB/CIFS on LAN or Windows/NAS shares, but over WebDAV over HTTPS may not preserve metadata such as timestamps or attributes to allow for fine-grained incremental detection; the result can be “looks like everything changed” and complete copies every time.

If you need transfer over native HTTPS with real incremental, evaluate open source solutions like rclone (supported by WebDAV and many providers) or mounts that preserve attributes correctly. Another way is to use secure tunnels (e.g., rsync over SSH (if the environment allows) to maintain efficient change detection. In any case, test in a controlled environment to confirm that The timestamps and sizes look as you expect before going into production.

Incremental vs. differential copies and synchronization vs. image

Both increase and differential save time and space copying only changes, but their restoration differs: incremental requires the full base copy plus all incrementals to date; differential only needs the full copy and the latest differential.

In terms of copying, incremental copying is usually faster; In recovery, the differential wins since fewer points are needed. Choose based on your priority: backup window or restore speed.

Syncing files does not create a recoverable image, but a "clear" replica for working on the fly. Image copies allow you to go back in time, perfect for incidents and human errors, while maintaining historical data.

With Robocopy you can approach an incremental policy with /MIR, /XO, age filters and attributes; With imaging software you add the restoration layer to previous points without depending on the error not having propagated.

If you are looking to automate “incrementals” with Robocopy, combines a good syntax foundation, selection filters, I/O limits and registers, adding Task Scheduler or monitoring with /MOT and /MON. When you need to go back in time, rely on versioned images to complement synchronization; and if your case requires HTTPS, try tools geared toward that transport that properly preserve metadata, avoiding surprises with unnecessary full copies.

Daniel Terrasa

Editor specialized in technology and internet issues with more than ten years of experience in different digital media. I have worked as an editor and content creator for e-commerce, communication, online marketing and advertising companies. I have also written on economics, finance and other sectors websites. My work is also my passion. Now, through my articles in Tecnobits, I try to explore all the news and new opportunities that the world of technology offers us every day to improve our lives.