Customer was running full backups once a week during the weekend and daily incremental backups during the week. However, during the first incremental backup of the week, it looked as if Presstore was backing up everything. We turned on debug logging and discovered that each one of the files that were being backed up had had its 'ctime' updated. The customer later discovered that the reason for 'ctime' being updated was SOPHOS ANTIVIRUS. It scanned the server after each full backup and before the first incremental backup of the week. This updated each scanned file's ctime - causing Presstore to back it up at the next opportunity.

For more details on atime, ctime & mtime see here

http://www.unix.com/tips-tutorials/20526-mtime-ctime-atime.html

For more details on how Presstore determines whether or not a files should be backed up:

https://support.archiware.com/support/index.php?/Knowledgebase/Article/View/111/0/why-does-presstore-sync-or-backup-a-file-once-more