If you are using the modified time method to do your incremental backups, do take note that the scans done by some anti-virus software can cause your incremental backups to become full backups. When the anti-virus scans a file, the Last Access Date is changed to the time of the scan. The anti-virus software may modify this date to what it was before the scan and triggering the modified time in the USN to change. This results in the file being backed up during the next incremental backup even though it has not been modified.
Read the document below for a way to solve this problem if you are using Symantec Endpoint Protection
http://www.symantec.com/business/support/index?page=content&id=TECH102698&locale=en_US
If you encounter this problem and is using other anti-virus products, you should contact the vendor to see whether there is a similar solution.
