Abstract: A system for incremental backup comprises a storage device and a processor. The processor is configured to: 1) start Event Tracing for Windows tracking, to track changed block information in one or more maps, where each of the one or more maps tracks writes indicated via a node; 2) receive request for an incremental backup of a volume of one or more volumes, wherein the one or more maps track changed blocks from writes to the volume; 3) halt writes to the volume and queue writes to the volume after halting; 4) freeze the one or more maps of changed blocks; change Event Tracing for Windows tracking, wherein the change block info is tracked to a new set of maps; 5) determine changed blocks using the one or more maps; 6) write changed blocks to a backup volume; and 7) release writes to the volume.