How Differential Backup Works?

A Differential Backup will contain all data that has been changed
or been added since the last full database backup.

So how exactly SQL Server knows what data to backup?
The answer : by scanning the Differential Change Map pages.

One of the pages type is Differential Change Map (DCM) pages.
The DCM pages are bitmaps, where each bit represent an
extent in a data file.
Each bit in the bitmap can be ON or OFF specifying whether
the extent has been changed since last full backup or been
added to the database. Each bitmap covers 64,000 extents or
about 4 GB of a data file. A new bitmap created for each data file.

When a full backup is made all bits in the DCM paged set to 0.
Except a "copy-only" backup.

A differential backup scans through these bitmaps and backup
only the data file extents that are marked as changed.

Reference:
http://msdn.microsoft.com/en-us/library/ms345448.aspx