There's a type of allocation page called the DCM - the differential change map. It maps which extents have changed since the last full backup. Those extents are the only ones included in the diff backup. A full backup sets the bit to 0 for all extents.
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
We walk in the dark places no others will enter
We stand on the bridge and no one may pass