Survey of Windows update formats: The Delta update

Raymond Chen

Raymond

Last time, we began our survey of Windows update formats. We’ll continue with the Delta update.

The Delta update is a cut-down version of the Full update by including only files that changed since the previous version. Delta updates are typically around 300MB to 500MB in size, which is significantly less than the typical 1GB size of a Full update.

Delta updates send full files, not patches. The Delta is applied at the file level, not the byte level.

UpdateFull filePatch base
M0M1M2M3M4
M1
M1
M0 to M1    
M2
M2
M0 to M2M1 to M2   
M3
 
     
M4
M4
M0 to M4M1 to M4M2 to M4  
M5
M5
M0 to M5M1 to M5M2 to M5 M4 to M5

The breakdown of files for Delta updates is as follows:

Delta updateContents
M1M1
M2M2
M3(nothing)
M4M4
M5M5

Note that Delta update M3 contains nothing at all. That’s because the file F didn’t change between M2 and M3, so there was nothing to update.

Feature summary of Delta updates:

  • Delta updates can successfully update only customers who are running the previous monthly cumulative update (possibly with hotfixes). It cannot update customers who are more than one version behind.
  • Delta updates are a third to a half the size of a Full update.
  • Delta updates require a little bit of negotiation with the server to determine whether the client system is eligible, but once that’s determined, every eligible customer downloads the same update.
  • Delta updates are cache-friendly, because every customer downloads the same update (if they download anything at all). Therefore, caching features like caching proxies, BranchCache, and peer-to-peer delivery are effective.
  • Delta updates do not require significant server support. Once the package is negotiated, it is delivered in its entirety.

Next time, we’ll look at the Express update, which despite its name is actually larger than Full updates, or at least they’re larger on the server.

Raymond Chen
Raymond Chen

Follow Raymond   

4 comments

Comments are closed.

  • Avatar
    Piotr Siódmak

    I thought that to apply a patch you had to uninstall the currently installed one, effectively rolling back to the baseline (latest CU). Seemed logical because then patches are always applied against the common baseline (but every next patch would be bigger). Also I thought that was why C:\Windows\Installer keeps growing (keeps patch uninstallers).

    • Avatar
      Me Gusta

      The files in the Windows directories are actually hard linked to files in %SystemRoot%\WinSxS. For example, on my system:
      C:\>fsutil hardlink list c:\windows\system32\kernel32.dll
      \Windows\System32\kernel32.dll
      \Windows\WinSxS\amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.18362.329_none_e9af874ee7d1812d\kernel32.dll
      The way Windows Update applies an update is to install the files into the WinSxS directory then removes the old hard link and then creates a new hard link to the most up to date file. So all of the files live happily side by side in the WinSxS directory and so multiple updates with that file can be installed at the same time.
      The reason why the directory kept growing in Windows Vista and 7 is because there was no automatic checking the WinSxS directory for completely superseded patches. It was either Windows 8 or 8.1 where this was added and actually happens automatically. If you run C:\Windows\system32>dism /online /cleanup-image /analyzecomponentstore you will get output that includes the following:
      Date of Last Cleanup : 2020-01-29 17:52:54

      Number of Reclaimable Packages : 2
      Component Store Cleanup Recommended : Yes
      If you then run dism /online /cleanup-image /startcomponentcleanup then this will manually remove patches that are not in use by Windows.
      As a note, a patch can be partially in use, that is some files are hard linked into the Windows directory but other files have newer versions available and these have been obtained from other patches. In this case Windows will not be able to remove the patch since Windows will only remove the entire patch.
      Finally, the /startcomponentcleanup option has the /resetbase option. What this does is to make the current patch level the baseline for Windows and removes the files that have been superseded by the current patch from the baseline image.

  • David Streeter
    David Streeter

    How does deleting files work? e.g. a file is added in M2 but later removed in M4.

    Is there a list of files to delete, or do obsolete files just get left lying around, unloved?