How to investigate spikes in incremental backup

[virtualwatts]

Greetings,

We are using B&R 5.0.1, Veeam server is a VM, SAN storage
We run forward (normal) incrementals with weekly synth fulls
All of our servers are Windows servers 2000/2003/2008

A couple of our nightly incrementals spike up in size and I am trying to figure out how to find the culprits.
Certainly I can look on the server at the mod dttm on files that exists, but files changed do not reconcile to size of incrementals.
And that makes sense because it uses CBT.
If the changed block is due to a major absence of a file (e.g. Windows block recovery or something) I'm not sure how to investigate.

Is there anything on the Veeam side, at the application or in the files, that would help me investigate what is inside an incremental backup?

We are starting a small project to reduce the waste in our incremental backups of Windows servers, which in turn reduces the wan bandwidth to transmit them and the storage space to house them.

Thanks
Rick

[Gostev]

Hi Rick, that is interesting project for sure. This is one of the most interesting questions on this forum lately for sure... hmm, let me think... have you thought about creating a test job with compression disabled, and trying to figure out what was changed by looking at raw binary content of VIB file? Thanks.