February 11th, 2020

Survey of Windows update formats: The Delta update

Raymond Chen

Last time, we began our survey of Windows update formats. We’ll continue with the Delta update.

The Delta update is a cut-down version of the Full update by including only files that changed since the previous version. Delta updates are typically around 300MB to 500MB in size, which is significantly less than the typical 1GB size of a Full update.

Delta updates send full files, not patches. The Delta is applied at the file level, not the byte level.

Update	Full file	Patch base
Update	Full file	M0	M1	M2	M3	M4
M1	M1	M0 to M1
M2	M2	M0 to M2	M1 to M2
M3
M4	M4	M0 to M4	M1 to M4	M2 to M4
M5	M5	M0 to M5	M1 to M5	M2 to M5		M4 to M5

The breakdown of files for Delta updates is as follows:

Delta update	Contents
M1	M1
M2	M2
M3	(nothing)
M4	M4
M5	M5

Note that Delta update M3 contains nothing at all. That’s because the file F didn’t change between M2 and M3, so there was nothing to update.

Feature summary of Delta updates:

Delta updates can successfully update only customers who are running the previous monthly cumulative update (possibly with hotfixes). It cannot update customers who are more than one version behind.
Delta updates are a third to a half the size of a Full update.
Delta updates require a little bit of negotiation with the server to determine whether the client system is eligible, but once that’s determined, every eligible customer downloads the same update.
Delta updates are cache-friendly, because every customer downloads the same update (if they download anything at all). Therefore, caching features like caching proxies, BranchCache, and peer-to-peer delivery are effective.
Delta updates do not require significant server support. Once the package is negotiated, it is delivered in its entirety.

Next time, we’ll look at the Express update, which despite its name is actually larger than Full updates, or at least they’re larger on the server.

Author

Raymond Chen

Raymond has been involved in the evolution of Windows for more than 30 years. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie-jeebies. The Web site spawned a book, coincidentally also titled The Old New Thing (Addison Wesley 2007). He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information.

4 comments

Discussion is closed. Login to edit/delete existing comments.

Sort by :

Newest

Newest Popular Oldest

David Streeter February 11, 2020 0

How does deleting files work? e.g. a file is added in M2 but later removed in M4.

Is there a list of files to delete, or do obsolete files just get left lying around, unloved?
- cheong00 February 11, 2020 0
  
  Since Delta updates are incremental update, for any files that should be delete in N+1 update level, it would be deleted promptly.
  
  If it were to be uninstalled, there is a reason why Windows create restore point on update.
  
  https://docs.microsoft.com/en-us/windows/win32/sr/restore-points
Piotr Siódmak February 11, 2020 0

I thought that to apply a patch you had to uninstall the currently installed one, effectively rolling back to the baseline (latest CU). Seemed logical because then patches are always applied against the common baseline (but every next patch would be bigger). Also I thought that was why C:\Windows\Installer keeps growing (keeps patch uninstallers).
- Me Gusta February 11, 2020 0
  
  The files in the Windows directories are actually hard linked to files in %SystemRoot%\WinSxS. For example, on my system:
  C:\>fsutil hardlink list c:\windows\system32\kernel32.dll
  \Windows\System32\kernel32.dll
  \Windows\WinSxS\amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.18362.329_none_e9af874ee7d1812d\kernel32.dll
  The way Windows Update applies an update is to install the files into the WinSxS directory then removes the old hard link and then creates a new hard link to the most up to date file. So all of the files live happily side by side in the WinSxS directory...
  Read more
  The files in the Windows directories are actually hard linked to files in %SystemRoot%\WinSxS. For example, on my system:
  C:\>fsutil hardlink list c:\windows\system32\kernel32.dll
  \Windows\System32\kernel32.dll
  \Windows\WinSxS\amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.18362.329_none_e9af874ee7d1812d\kernel32.dll
  The way Windows Update applies an update is to install the files into the WinSxS directory then removes the old hard link and then creates a new hard link to the most up to date file. So all of the files live happily side by side in the WinSxS directory and so multiple updates with that file can be installed at the same time.
  The reason why the directory kept growing in Windows Vista and 7 is because there was no automatic checking the WinSxS directory for completely superseded patches. It was either Windows 8 or 8.1 where this was added and actually happens automatically. If you run C:\Windows\system32>dism /online /cleanup-image /analyzecomponentstore you will get output that includes the following:
  Date of Last Cleanup : 2020-01-29 17:52:54
  
  Number of Reclaimable Packages : 2
  Component Store Cleanup Recommended : Yes
  If you then run dism /online /cleanup-image /startcomponentcleanup then this will manually remove patches that are not in use by Windows.
  As a note, a patch can be partially in use, that is some files are hard linked into the Windows directory but other files have newer versions available and these have been obtained from other patches. In this case Windows will not be able to remove the patch since Windows will only remove the entire patch.
  Finally, the /startcomponentcleanup option has the /resetbase option. What this does is to make the current patch level the baseline for Windows and removes the files that have been superseded by the current patch from the baseline image.
  
  Read less