We all love happy snaps. They let us enjoy reliving a moment, the beauty of an instant captured. Snapshot backups are very similar. Taken at a moment in time, they enable us to return to that point in our computer state.

Backups exist to preserve valuable data against computer failure. For this reason, file-based backups (keeping copies of key files on backup media) have been popular for a long time. However with file-based backups, a complete system recovery is slow. After repairing or replacing the affected computer, the operating system and all programs have to be re-installed, updated, configured and brought back to the prior state, and then the backed-up files restored to their original locations. Not only is this slow, it also has many potential points of error which can lead to the system not being quite in the same state as before the crash.

A second problem is that because it takes a long time to copy individual files to backup media, it can rarely be done while the computer is performing its normal duties. Very often, sets of files need to copied at the same point in time in order to be valid. Whether it’s an accounting system, an email store or a production database, even a few seconds between copying one file and its partners may render the backup invalid, and sensible recovery impossible. In practice, this usually restricts file-based backups to being done at night, when systems are idle. In these fast-moving times, a day is a long time between backups!

What is required is a snapshot that can somehow capture an entire system at a single point in time, and do it throughout the day while the system is in full flight! This requires that all complex file structures are somehow forced to pause for an instant and write everything they are doing to disk, so that the snapshot is in a consistent state if it ever has to be restored. Sounds impossible, doesn’t it?

Snapshot backup uses a few nifty tricks to make the impossible possible. The first step is to get all the programs running on a computer to stop for an instant, and write all their current files to disk. But some programs may be part-way through a complex transaction involving changes to many different files. When tapped on the shoulder, these programs have to finish all incomplete transactions while not starting any new ones, and then signal that they are ready for a snapshot.

But if a computer has large amounts of busy storage, surely a snapshot will take a very long time to create? Computers will die if they hold their breath for too long! In fact, the snapshot takes almost no time, due to another clever trick. It doesn’t actually do much at all! All the snapshotting tool has to do is mark a point in time, and then watch for anything that might alter the picture. That is, it looks for anything that writes to disk after the snapshot has been taken. If it sees a disk write taking place, it interrupts for a moment and takes a copy of the sector(s) as they were before the write does its job. And it keeps a list of sectors that have changed. This is known as Copy-on-Write.

The third phase is copying the snapshot to storage media – the originals of sectors that haven’t changed since the snapshot instant, and the copies of sectors that have since changed. However, since whole sectors are copied at a time, even this operation can be faster than file-by-file copies. Another smart trick that snapshot backup tools can perform in this phase is incremental backups. Rather than snapshot the entire system every time, the tools can record only what has changed since the last snapshot. This is often less than 5% of the total amount of disk in use and so takes much less time and storage space.

Using all these techniques, a Windows server in full flight can take incremental snapshot backups in only a few minutes. And the server’s workflow is only interrupted for a few seconds. This, in turn, means that snapshot backups can be taken at intervals (say hourly) throughout the working day. And the result is a complete and consistent picture of the server’s entire state, which means recovery is largely a process of copying this image back to the disks. (If there are hardware or disk layout changes, this becomes a little more complex, but still much simpler than recovering from file-based backups.) Not only that, but depending on how many snapshots are retained, it is possible to do full point-in-time restores of individual files, whole partitions, or even whole servers!

So the key strengths are:-

• Backups performed regularly throughout the day, not just daily (or less!)
• Point-in-time recovery of files, folders, partitions or whole systems
• Recovery of whole systems in only 2-4 hours, to bare and/or different hardware

Why isn’t everyone using snapshots? Not enough people know about the benefits! There are certainly situations where file-based backups are adequate, typically when all you need is the data itself. But for fast and efficient system backups and disaster recoveries, as well as point in time file recovery, nothing beats snapshots! Best of all, snapshot backup tools are not more expensive than their file-based brethren. Note however that because they are often used to take more frequent backups, the amount of media required is often significantly greater.

If you’re not sure about the state of your backup and disaster recovery, contact the IT Department to arrange a test restore of your backups and a step forward in peace of mind.