What is a Snapshot?

What is a Snapshot?

When it comes to data security and disaster recovery, the term "snapshot" is frequently encountered. So, what is a snapshot? In this guide, we will explain step by step what snapshots are, how they work, why they are important, and how to choose the right snapshot strategy. Understanding this fundamental concept is critical to ensuring the security of your data and being prepared for unexpected situations.

What is a Snapshot?

In simple terms, a snapshot is an instantaneous image of the complete state of a storage system, virtual machine, or database at a specific point in time. This instantaneous image captures and stores the data in its state at that moment. Just like a camera captures a fleeting moment, a snapshot captures the state of a file system or virtual machine at a particular time.

Snapshots are different from backing up your data. While a backup typically creates a full copy of the data, snapshots usually only record the changes made since that moment. This allows snapshots to be faster and use less storage space. However, snapshots alone are not a complete backup solution and are often used as part of a backup strategy.

How Do Snapshots Work?

The working principle of snapshots can vary depending on the technology used. However, there are generally two main approaches:

1. Copy-on-Write (CoW)

In this approach, the original data block is copied before it is modified. When a data block is to be changed, the system first takes a copy of the original block and saves it. Then, it overwrites the original block with the new data. The snapshot points to these original copied blocks. This way, it preserves the state of the data at the time the snapshot was taken.

Advantage: The snapshot creation process is fast because only metadata is updated.

Disadvantage: Over time, as more changes are made and more snapshots are taken, storage performance can degrade because the system constantly has to manage original and modified blocks.

2. Write-on-Write (WoW)

In this approach, new data is written directly to new blocks, and the snapshot continues to point to the original blocks. The old data blocks are preserved until the snapshot is restored.

Advantage: Storage performance is generally more consistent compared to Copy-on-Write.

Disadvantage: The snapshot creation process may require more resources compared to Copy-on-Write.

Types of Snapshots

Snapshots can be taken at different levels:

Storage Snapshots: These are features offered by storage arrays. These snapshots capture an instantaneous image of all data on a specific storage unit (e.g., a LUN or a shared folder).

Virtual Machine (VM) Snapshots: These are features offered by virtual environments (like VMware, Hyper-V). A VM snapshot saves the virtual machine's disks, memory, and device state as they are at that moment. This is useful for reverting a VM to a previous state.

Database Snapshots: Some database systems offer snapshot capabilities to capture the state of the database at a specific point in time. This can be useful for reverting database changes or creating test environments.

File System Snapshots: Some file systems (like ZFS, Btrfs) have built-in snapshot capabilities. These preserve the data at a specific point in the file system.

What are the Benefits of Snapshots?

Snapshots provide many significant benefits for data management and security:

Fast Recovery: Snapshots allow you to quickly restore systems or data to a previous state. This can be a lifesaver, especially when an update fails, in case of a malware attack, or when data loss occurs due to human error.

Data Recovery: They can be used to recover accidentally deleted files or corrupted data.

Complementing Backup Strategy: Snapshots strengthen your backup strategy by providing short-term data protection between full backups. Regularly taken snapshots minimize data loss that might occur between full backups.

Testing and Development: Developers and test engineers can use snapshots to test their software or updates in a safe environment. If a problem occurs, they can easily revert the system to its previous stable state.

Storage Efficiency: Especially snapshots using the copy-on-write mechanism use less storage space compared to full backups, as they only store the changed data.

Disaster Recovery: In the event of a physical disaster (fire, flood, etc.), snapshots stored in a remote location can be used to recover your data.

Things to Consider When Choosing and Using Snapshots

To create the right snapshot strategy and use snapshots effectively, it's important to pay attention to a few key points:

1. How Often Should Snapshots Be Taken?

This depends on your business requirements and the rate of data change.

Data with High Change Rate: For data with a high change rate, such as financial transactions, e-commerce sites, or continuously updated databases, more frequent snapshots (e.g., hourly or even more often) may be required.

Data with Low Change Rate: For data that changes less frequently, such as file servers or archived data, daily or weekly snapshots may be sufficient.

Before Critical Operations: A snapshot should always be taken before a significant software update, configuration change, or maintenance.

Retention Policy: Define a "retention policy." For example, "hourly snapshots for the last 24 hours, daily snapshots for the last 7 days, and weekly snapshots for the last 4 weeks." This provides access to current data while managing storage space.

Performance Impact: A large number of old snapshots can have a negative impact on performance. It is important to regularly clean up old and unnecessary snapshots.

Separate Storage: If possible, store your snapshots on a different storage system than your original data. This provides additional protection against a storage failure.

Offsite Locations: For disaster recovery scenarios, storing your snapshots in a different geographical location is the safest approach. This protects you from the effects of a local disaster (fire, flood, etc.).

Regular Monitoring: Regularly monitor the impact of your snapshots on performance.

Cleaning Up Old Snapshots: Regularly delete unnecessary snapshots to avoid performance degradation.

Snapshot Chains: Avoid creating "snapshot chains" where many snapshots are linked together. This can lead to slower recovery.