Information identifying a set of changed blocks on a volume of a client are received. The changed blocks are blocks of the volume that have changed since a previous backup of the client. The set of changed blocks are filtered to identify a subset of changed blocks that are associated with a particular file. The subset of changed blocks is streamed to a backup storage server for storage as an incremental virtual hard disk file. The incremental virtual hard disk file is associated to a full backup virtual hard disk file, where the full backup virtual hard disk file is a full backup of a previous version of the particular file.