Snapshot

A snapshot is a point-in-time capture of data. It records what a hard drive, a directory, or a data collection looked like at a specific second. Afterward, everything may keep changing, but the captured state remains untouched. The comparison with a photograph fits well: the photo shows the garden in May, even if everything grows differently by August. The English word means exactly that, namely a quick photograph. In technology, however, a snapshot is not just there to look at — one can restore the earlier state at any time.

The lifeline in case of errors and attacks

Software breaks. An update goes wrong, a command deletes the wrong file, a hard drive fails. Without a preserved earlier state, weeks of work are then lost. With a snapshot, returning to the last working state often takes only minutes.

This is especially important with ransomware, i.e. programs that encrypt all of a company’s files and then demand money. Anyone who has hourly snapshots that cannot be altered from outside can restore the state from just before the attack. This is precisely why many insurers and authorities now mandate such procedures.

But there is also a second reason that has nothing to do with disasters. Research and accounting need fixed reference points. If two teams want to recompute the same result, they must work with the same data. A snapshot fixes exactly which data state is meant.

Why a snapshot hardly needs any storage space

A naive approach would be to simply copy everything. For an eight-terabyte hard drive, that would be slow and expensive. That’s why modern systems use a trick called copy-on-write: copying only happens upon writing. When the snapshot is created, almost nothing happens. The system merely notes which data blocks were valid at that point in time.

Only when a block is later about to be overwritten is the old version set aside. So only the parts that are actually changed cost additional space. A snapshot of a huge database can therefore initially occupy just a few megabytes and grow over time.

A common mistake is equating a snapshot with a backup. A backup resides on a different device, often in a different location. A snapshot usually resides on the same hardware as the original data. If the server room burns down, both are gone. Snapshots are thus fast, but they do not replace a genuine backup copy at a second location.

Snapshots in the cloud, on phones, and in AI training

Anyone using an iPhone or a Mac probably uses snapshots without knowing it. Before every system update, the device creates one so it can revert in case of problems. The version history in Dropbox or Google Drive is likewise based on the same principle. For rented servers in data centers, a snapshot button is standard equipment.

In the AI world, the word appears in two meanings. First, during training: large models compute for weeks, so the intermediate state is regularly saved. Such intermediate states are usually called checkpoints, but they function like snapshots. If a machine fails, one starts from the last saved state instead of from zero.

Second, with the training data itself. When a company states that its chatbot only knows events up to a certain month, behind that lies a snapshot of the internet from that time. In financial news, in turn, a snapshot often refers to a cutoff date, such as the holdings of a portfolio at the end of a quarter. What all these uses have in common is the same idea: a clearly dated, immutable state.