Snapshot is Not Backup: 5 Reasons
Direct answer
A snapshot is an instant photo of the volume, created via copy-on-write or redirect-on-write. It is fast, useful and cheap, but depends on the original storage. If storage fails or is encrypted, snapshots fall together. Backup is an INDEPENDENT copy on another medium.
Technical difference in 60 seconds
Snapshot: storage marks the current state and starts writing modifications elsewhere (copy-on-write). You 'roll back' to the previous state by referencing the mark. Cost: near zero. Creation time: seconds. Dependency: 100% on original storage. Backup: data is PHYSICALLY copied to another medium (disk, tape, cloud). Can be restored even if the original storage disappears. Cost: higher. Time: minutes to hours by volume.
Common mistakes treating snapshot as backup
- 1.Trust VMware snapshot as anti-ransomware protection. Linux-ESXi ransomware (BlackCat, LockBit) encrypts the entire VMFS datastore. All snapshots fall with the original VMDKs.
- 2.Delete production thinking snapshot 'saves' it. Snapshot only preserves the pre-change state. If you delete the VM, in most implementations the snapshot goes with it.
- 3.Daily snapshot as the only strategy. Without independent copy, storage failure = total loss. Snapshot helps in accidental-change rollback, not in disaster.
- 4.Ignore performance impact of long snapshots. VMware snapshot active for days degrades IOPS exponentially. Do not use as 'permanent backup'.
FAQ
What is snapshot for then?
Legitimate cases: (1) fast rollback pre-software/OS upgrade; (2) consistency point before risky operation (database migration, deploy); (3) base for off-host backup (Veeam creates snapshot, reads from it, deletes); (4) fast copies for test/QA.
Is ZFS snapshot different from VMware snapshot?
Same essence (reference to pre-modification state), different architecture. ZFS is more robust: snapshots are read-only by design, do not degrade performance, and can be replicated via 'zfs send/receive' as true backup. Even so, send to another pool = backup.
Is Windows Volume Shadow Copy a backup?
No. VSS is snapshot technology embedded in NTFS. Windows Backup (Windows Server Backup, Veeam) USES VSS as quiesce mechanism but the result is independent copy. Modern ransomware deletes shadow copies (vssadmin delete shadows) before encrypting.
How to know if a 'backup solution' is just snapshot in disguise?
Ask: 'if I delete the source storage, does the backup still exist?'. If the answer is 'yes, on another medium/array/cloud', it's backup. If 'no, depends on the original storage', it's snapshot.
Does snapshot consume space?
Only the delta (changes since creation). Volume with little change: ~5-10% of size per snapshot/month. Volatile volume: 50%+ rapidly.
Want to audit your current protection strategy?
Backup + DR analysis + blind-spot identification.