What Are NAS Snapshots? Point-in-Time Recovery and Ransomware Protection

Delete the wrong folder, or watch ransomware start encrypting your files, and the question becomes brutally simple: can you get yesterday's version back? NAS snapshots are how you answer yes. They capture the state of your files at a moment in time and let you roll the whole share back to before the damage, and on a copy-on-write system they do it almost instantly while barely touching your storage.

Quick Answer

A NAS snapshot is a read only, point in time record of your files made using copy-on-write, so it references unchanged blocks instead of copying data. That means a snapshot is near instant to create and uses almost no space until files change. If ransomware encrypts your share or you delete something by mistake, you restore from a snapshot taken before the event.

How copy-on-write makes snapshots nearly free

The clever part is that a fresh snapshot copies almost nothing. Instead of duplicating your files, it points at the existing data blocks and marks them. When a file later changes, the system writes the new version to a fresh block and leaves the original untouched, so the snapshot still sees the old data. That is copy-on-write: you only consume extra space as the live data diverges from the snapshot.

The practical upshot is that you can keep many snapshots, taken often, without filling the drive. A NAS using the Btrfs file system, common on Synology and other platforms, takes them near instantly and with little performance impact, which is why scheduled hourly or daily snapshots are realistic rather than a luxury.

Why snapshots beat ordinary backups against ransomware

Snapshots are always read only. The previous versions they hold cannot be altered, so even while ransomware is busy encrypting your live files, the snapshot of the clean versions sits untouched. You roll back to the last snapshot taken before the infection and your data returns.

Stronger still are immutable snapshots, sometimes called WORM for write once read many. These prevent anyone, including an administrator or a compromised admin account, from deleting the snapshots for a set retention period. That closes the obvious attack: clever ransomware tries to wipe the snapshots too, and immutability stops it.

There is an important limit to be honest about. Snapshots live on the same NAS, so they do not protect against the drive pool failing, the device being stolen, fire, or an attacker with full admin access who destroys both the data and the snapshots. Snapshots are your fast first line of recovery, not a substitute for a separate offsite backup. Use both. Choosing the right drives for that snapshot capable volume matters too, and the SSD best sellers at Evetech are a quick reference for fast, reliable storage.

Using snapshots well

Set a schedule that matches how often your data changes, keep a sensible retention window so you can reach back days or weeks, and enable immutability on anything you would lose sleep over. Then test a restore once so you know the process before you ever need it under pressure.

Frequently Asked Questions

How do NAS snapshots differ from a backup?

A snapshot is a point in time view stored on the same NAS using copy-on-write, ideal for fast rollback. A backup is a separate copy, ideally offsite. Snapshots recover quickly from deletion and ransomware, but only a real backup survives the NAS itself failing or being stolen.

Do snapshots take up a lot of space?

Very little at first. Thanks to copy-on-write, a new snapshot references existing blocks and only consumes extra space as files change. This is why you can keep many frequent snapshots without quickly filling the volume.

Can ransomware delete my snapshots?

Standard snapshots are read only but could be removed by an attacker with admin access. Immutable, or WORM, snapshots solve this by blocking deletion for a set retention period, even by an administrator, which makes them genuinely ransomware resistant.

What do I need on my NAS to use snapshots?

The volume must use a file system that supports copy-on-write snapshots, commonly Btrfs on Synology and similar platforms, along with the relevant snapshot package. Check that your model and volume are configured for it before relying on snapshots.

Should I still keep a separate backup if I have snapshots?

Yes. Snapshots are fast local recovery, but they sit on the same device, so a drive pool failure, theft or fire takes them with your data. Pair snapshots with an offsite or detached backup for full protection.