Ask anyone running a serious home NAS why they chose ZFS, and snapshots will be near the top of the list. They are one of the most powerful data-protection tools available, they cost almost nothing in space or performance, and they can rescue you from ransomware, fat-finger deletions, and botched edits in seconds. Yet they are widely misunderstood, and one dangerous myth deserves clearing up immediately.
What a snapshot actually is
A ZFS snapshot is a frozen, read-only picture of your file system at a single moment in time. Take one and ZFS records exactly how every file looked right then. Crucially, creating a snapshot is instantaneous and initially uses zero extra space, because it does not copy any data.
How that is possible: copy-on-write
ZFS never overwrites data in place. When you change a file, it writes the new version to a fresh location and updates pointers, leaving the old blocks intact. A snapshot simply keeps references to those old blocks so they are not freed. Space is only consumed gradually, as original data diverges from the snapshot, meaning a snapshot’s size equals the amount of data changed or deleted since it was taken, not the size of your whole pool.
| Property | ZFS snapshot |
|---|---|
| Time to create | Instant |
| Initial space used | Effectively zero |
| Space growth | Only as data changes/deletes |
| Restore speed | Instant rollback or per-file copy |
| State | Read-only, immutable |
How snapshots protect you
Because a snapshot is immutable, it is a time machine you cannot accidentally corrupt. Deleted a folder? Roll back or browse the snapshot and copy the file out. A ransomware attack encrypted your shares? The snapshot from before the attack still holds clean, unencrypted originals, and the malware cannot alter read-only snapshots. You can schedule them automatically, keeping, say, hourly snapshots for a day, daily for a month, and monthly for a year, all with minimal storage cost.
The dangerous myth: snapshots are not backups
This is the point that matters most. A snapshot lives on the same pool as your data. If the pool dies, the drives fail, the server is stolen, or the house floods, the snapshots die with it. Snapshots protect against logical disasters (deletion, corruption, ransomware) but not physical ones. A real backup means copying data to separate hardware, ideally offsite. The good news is that ZFS makes this easy too, via replication.
Replication: turning snapshots into real backups
ZFS can send a snapshot to another ZFS system with send and receive, and after the first full transfer, subsequent sends are incremental, shipping only the changed blocks. Replicating snapshots to a second NAS or an offsite box gives you the best of both worlds: instant local recovery from snapshots plus a genuine, separate backup that survives hardware loss.
Automating a sensible retention policy
Snapshots are only as useful as your schedule. A common and effective policy keeps frequent snapshots for the recent past and thins them out over time: every 15 minutes for a few hours, hourly for a day, daily for a month, and monthly for a year. TrueNAS and other ZFS platforms include snapshot task schedulers that create and prune these automatically, so old snapshots expire and free their space without manual effort. The result is deep, granular history at a fraction of the storage a traditional versioned backup would need.
Browsing and restoring made simple
Recovering a file rarely means a full rollback. ZFS exposes snapshots through a hidden directory on each dataset, and network shares can present “previous versions” so users restore their own files without admin help. That everyday convenience, undoing a bad save from an hour ago in seconds, is what turns snapshots from a technical feature into a genuine daily safety net.
FAQ
Do snapshots slow down my NAS?
Practically no. Thanks to copy-on-write, taking and keeping snapshots adds negligible overhead. Keeping an enormous number of very old snapshots can slightly increase management work and hold space that would otherwise be freed, but for normal schedules the impact is imperceptible.
How much space will snapshots use?
Only as much as the data that changes or is deleted after each snapshot. A pool with mostly static files uses very little; one with heavy daily churn uses more. You control the trade-off with retention policies that prune old snapshots automatically.
Bottom line
ZFS snapshots are instant, near-free, immutable points in time that let you undo deletions, corruption, and ransomware in seconds. Just remember they are not a backup on their own because they share the pool; pair them with replication to separate hardware and you have a storage safety net that is hard to beat.
