Can anybody help with different approaches identifying modified disk blocks in a filesystem? Finding out a way to get list of modified blocks on filesystem and backup them?
To determine if a block has been modified you need some record of its previous contents. The most accurate way of doing this is with a simple block copy, but of course that needs twice the disk space. For a smaller footprint you could summarise the block contents, for example with an MD5 checksum, but you can't map a large number onto a small number without some risk of duplication, for instance if the block contents change in such a way that the MD5 of both copies is identical, you wouldn't be able to determine that from the new and old MD5s. The other problem with a block-based backup is that this doesn't necessarily map well onto the filesystem. If the filesystem is reorganised without any files changing, for example with a defragger, then a block-based incremental backup won't be able to restore. Since users care about files, not blocks, it would be a better idea to perform a file-based backup than a block-based backup.