Abstract: A system for incremental backup comprises a storage device and a processor. The processor is configured to: 1) start fileIO ETW tracking, wherein a file changed block info is tracked in map(s), wherein each of the map(s) tracks writes indicated via a node of a set of nodes; 2) receive request for an incremental backup of one or more files of one or more volumes, wherein the map(s) track changed blocks from writes to the one or more files; 3) halt writes to the one or more files and queue writes to the one or more files after halting; 4) freeze the map(s) of changed blocks; 5) change file IO ETW tracking, wherein the change block info is tracked to a new set of maps; 6) determine changed blocks using the map(s); 7) write changed blocks to a backup volume; and 8) release writes to the one or more files.