The speed of the differential backup is clearly too fast for TrueImage to have actually read and compared all the sectors stored in the full backup to the current sectors on the disk. Also if I boot into Linux and directly change a sector within a file. Then reboot into Windows and run a TrueImage differential backup, the changed is NOT detected. I would like to know the technique used to detect the changes that the differential backup backs up. I am speculating that it uses the file modified timestamps and compares them to the timestamps on the files in the full backup? It is important to know how it detects the changes so I know what trouble I may get into when, for instance: 1. booting into different operating systems 2. Using TrueImage to back up a removeable or external drive that may be plugged into several different computers. Anyone have the inside skinny? Thanks!