Alex Pankratov :
Dec 17, 2018
Looked at a similar idea, which is to use NTFS journal to track file modifications. This requires enabling write tracking for the volume, but it's trivial to do and this doesn't add much of operational overhead when enabled.
That's a solution that lies on the surface. I suspect it might be possible to do the same without relying on write journaling, by merely tracking how MFT changes between the runs and caching some information about it between the backup runs, but this will require a bit more investigation.