HD Doctor Logo

Snapshot: What it is, how it works and why it matters

Direct answer

A snapshot is a point-in-time image of a volume, filesystem or VM, created via copy-on-write or redirect-on-write without duplicating unchanged data.

Full definition

Common implementations: VMware vSphere snapshot (on VMDK), Hyper-V Production Checkpoints, ZFS snapshot, Btrfs snapshot, AWS EBS snapshot, Azure Disk Snapshot, NetApp SnapShot. Snapshots are fast (seconds) and space-efficient, but depend on the original volume: if the underlying disk fails or is encrypted, snapshots on the same storage fall along. Snapshot is NOT backup. Modern ransomware attackers (BlackCat, LockBit) delete VMware/Hyper-V/VSS snapshots before encrypting. Snapshot helps with accidental-operation rollback and fast granular restore, but must be complemented by immutable offline backup for ransomware protection.

Need to recover data or have a technical question?

Senior engineers in PT, EN and ES.

Related terms