Snapshots are a point-in-time copy mechanism used across platforms like AWS, VMware, and Windows to capture system or file states without duplicating entire datasets. They support backup workflows but are best suited for short-term use rather than long-term data protection.
Snapshots & Backups
Snapshots are another thing that we can use, either as backup or to help aid us in backing up. So let's discuss snapshots.
Talking about snapshots is a little strange for me, because throughout my career I've encountered many definitions, many different technologies that use this term snapshots, and they all use it in a little different light. So what I'm going to do is just explain a few different types of snapshots and how they relate to backups. We're going to go through a few variations of this.
The general concept usually is about the same. Snapshots are a way to create copies of something. So let's say we have a file right here, and what we want to do is create a copy of this file. Instead of actually creating an actual copy, which would take up twice as much space, instead what we do is start tracking the changes to that file right there. In doing so, we essentially created a snapshot. That snapshot is a moment in time, and then we're just recording the differences. So if this file gets accessed, what happens is it takes the original and then merges that with all the changes from that to present what the current version of this is. So this is the idea behind most of the technologies — not all, but most of the technologies — when it comes to snapshotting.
Quite honestly, I couldn't tell you if that's how Amazon Web Services snapshotting works, but essentially when it comes to volumes — or you can think of it as drives — when it comes to drives within AWS, we can create a snapshot. And from at least the interface, it just looks like a copy. So now we have a copy of one of those drives. It's a virtual drive, and, once again, we call them volumes, but essentially what we're doing is creating a copy of a drive.
Another area where we see snapshots is within VMware. VMware uses snapshots in a very typical way that we would see snapshots being created. That is, a virtual machine is just a bunch of files on the back end, and you can actually go and look at what those files look like. So there's these files, and they have changes that get committed to these files. But when you take a snapshot, it will create a change file and then essentially freezes the original file, so that stays the same, and then just starts tracking the changes on a separate file. Now, in order to understand its running state, it's got to combine both the original file and the change log to come up with the running state of the machine.
So this is used for very temporary backups. It's not really a long-term solution. I mean, snapshotting in general is not a long-term solution, because, hey, look, you're not creating an actual copy of the whole file. But especially in VMware, it's very short-lived, because as it generates more and more of these change log files, it really slows down and really causes problems with the machine. So it's just something that you would do for maybe just trying something out. Like, maybe you take a snapshot, you then try something out, and then an hour later you revert back to the original. Or maybe if you want to keep it, then you roll the changes back in, because what happens is the changes get rolled back in. So this is all to say that with VMware, you can use it as kind of like a brief little backup of something that you can restore and revert to an earlier version. But be careful with this one.
Then we also have snapshotting when it comes to Windows. When it comes to something like volume shadow copy, or when you're doing backups, it uses this thing where it snapshots a file. The thing is, if we were to back up a file — let's say we were backing up this file right here — well, that file could be actively being changed. So now, if you're in the middle of copying the data and suddenly data is changing on the end of this, this could corrupt your backup files, and this could be problematic.
So what Windows does is it creates a snapshot where, once again, this file kind of stays still and doesn't change, and then it does a separate file which has a change log of what is changing, and then it runs off of those. But what it allows you to do is copy this data right here and make a clean copy of the data. Then, once you're done with that, this service that is actually doing all of this will roll the changes back into the document. So it's a way to use this idea of snapshotting to take a backup. So you are able to take a clean backup.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →