

I dont know what's in the snapshots, but you can only try to manually recover this. You've not answered about backups, so I'll assume you dont have one - and while this is important to you, this only highlights how important backups are if you dont have one. Being on the same volume restoring these files from a snapshot is pretty quick.Lack of space, it being interrupted before completing the merge(s), speed, could all cause this. They are also useful keeping point in time backups in case a file is deleted. When coupled with data replication or traditional backup to tape snapshots are a useful backup tool. But since they are on the same physical disks and SAN/NAS/Server as the live file system this is still a single point of failure.

They are a tool that can be part of a backup strategy. Snapshots aren't a substitute for backups on their own. Where snapshots are done on the same volume instantly. Traditional backups dump the whole file system, or portion of it to tape or other disks. Your question is to how this differs from traditional backup. Which can also be explained better on wikipedia. This is done using a technique called copy on write.

From that point on any changes to the file system get associated with the current live file system leaving the disk structures associated with the snapshot untouched.

But basically when you create a snapshot the only thing that's happening is some metadata changes to create the snapshot. I think wikipedia can probably explain this in greater detail than I can do here. The data still must be copied off to another source to be protected. However, it's not a backup in the sense that if the drive fails, you'll still lose your data. If you "restore" Snap.0, it simply changes to the pointer to look at those blocks.ĭepending on the file system, this process can be very slick. If you take another snapshot, Snap.1 now points to A, B, and D. When you save the file, instead of overwriting those existing blocks, the newly altered "ServerFault.doc" takes up blocks A, B, and D (presuming block D contains the changes to the file) and now your file pointer points to A, B, and D (leaving C unaltered). It simply makes a copy of the pointer, but not the data. When you take a snapshot, Snap.0 (my name for the first snapshot) points at blocks A, B, and C. They're simply using pointers to point to another set of blocks on the drive.įor example, let's say you have a file called, "ServerFault.doc" and it takes up blocks A, B, and C on the hard drive.
