ZFS Snapshots Explained: A Homelab Guide to Instant Rollbacks
10 min read
1,830 words
If you use TrueNAS or any ZFS-based system, you have access to one of the most powerful data protection features in the homelab world: instant, near-zero-cost snapshots. A ZFS snapshot is a read-only, point-in-time copy of your data that uses almost no space until files change or are deleted. This guide explains exactly how ZFS snapshots work, how they differ from backups, and how to set up a snapshot schedule in TrueNAS that can roll you back from accidental deletion or ransomware in minutes.
How Do ZFS Snapshots Work? The Copy-on-Write Mechanism
ZFS snapshots rely on a fundamental design feature called copy-on-write (CoW). When you create a snapshot, ZFS does not duplicate your data. Instead, it simply records the current state of the dataset’s metadata. The existing data blocks remain untouched and are shared between the live dataset and the snapshot.
The magic happens when you modify or delete a file. ZFS writes the new data to a new location on disk, rather than overwriting the old blocks. The old blocks are preserved for the snapshot reference. This means a snapshot only starts consuming disk space when data changes after the snapshot was taken. The space used equals the size of the changed or deleted data, not the total dataset size.
Practical Example:
If you have a 1 TB dataset of family photos and take a snapshot, the snapshot initially uses 0 bytes of additional space. If you then delete 50 GB of photos, the snapshot will consume roughly 50 GB to retain those deleted files. If you never change anything, the snapshot remains essentially free.
ZFS Snapshot vs Backup: Why You Need Both
This is the single most important concept to understand: a ZFS snapshot is not a backup. A snapshot lives on the same physical pool as your active data. If your pool suffers a catastrophic failure — a dual-drive failure in a RAIDZ1, a power surge that fries the controller, or physical theft — your snapshots are lost alongside your data.
Snapshots Protect Against
- Accidental file deletion
- Ransomware encryption (if caught quickly)
- Bad software updates or configuration changes
- User errors (editing a file you shouldn’t have)
Backups Protect Against
- Complete hardware failure
- Fire, flood, theft (off-site backup)
- Pool corruption beyond recovery
- Ransomware that encrypts snapshots on the same pool
Setting a TrueNAS Snapshot Schedule and Retention Policy
TrueNAS makes snapshot scheduling straightforward through its web interface. A well-designed schedule balances recovery granularity against storage consumption. The best approach depends on how often your data changes and how quickly you need to recover.
Recommended TrueNAS Snapshot Schedule for Most Homelabs
| Frequency | Retention | Purpose |
|---|---|---|
| Every 1 hour | 24 hours (keep 24 snapshots) | Recover from accidental changes within the current day |
| Daily | 7 days (keep 7 snapshots) | Recover from yesterday’s mistakes |
| Weekly | 4 weeks (keep 4 snapshots) | Recover from issues discovered days later |
| Monthly | 3 months (keep 3 snapshots) | Long-term safety net for major blunders |
This schedule gives you a rolling window of recovery options while keeping total snapshot storage manageable. For a dataset with moderate daily changes (say 10-20 GB), this schedule typically consumes 50-150 GB of pool space — a small price for the protection it provides.
Good to Know:
TrueNAS automatically deletes old snapshots based on your retention rules. You don’t need to manually prune them. Just set the “lifetime” or “keep count” in the snapshot task, and TrueNAS handles the rest.
How to Create a Snapshot Task in TrueNAS
Navigate to Tasks → Periodic Snapshot Tasks
Click “Add” to create a new task. Select the dataset you want to protect.
Set the Schedule
Choose how often snapshots run. For most homelabs, hourly is a good starting point. You can also set specific days and times for daily/weekly/monthly tasks.
Define Retention Policy
Set the number of snapshots to keep for each frequency. TrueNAS will automatically delete the oldest snapshots when the limit is exceeded.
Enable “Recursive” for Datasets with Children
If your dataset has sub-datasets (e.g., for different users or applications), enabling recursive snapshots protects them all with one task.
Tip:
Start with hourly snapshots retained for 24 hours, plus daily snapshots kept for a week. Monitor your pool usage for a month, then adjust. Most homelabs find this schedule balances protection and storage cost well.
Rolling Back a Snapshot After Accidental Deletion or Ransomware
The real power of snapshots reveals itself when something goes wrong. Whether you accidentally deleted a critical file or ransomware encrypted your media library, a snapshot lets you restore the affected dataset to the state it was in when the snapshot was taken.
Rolling Back a Dataset to a Previous Snapshot
In TrueNAS, navigate to the dataset in the web interface, click the “Snapshots” tab, and select the snapshot you want to restore. Click the “Rollback” button. TrueNAS will revert the entire dataset to the snapshot state. Any data created after that snapshot will be lost, but all data that existed at snapshot time will be restored.
Warning:
A rollback is destructive to data created after the snapshot. If you have critical changes made after the snapshot that you want to keep, consider cloning the snapshot instead. A clone creates a writable copy of the snapshot state without affecting the live dataset.
Recovering a Single File from a Snapshot
For individual file recovery, you don’t need a full rollback. Snapshots are accessible as hidden directories within the dataset. On a TrueNAS system, navigate to .zfs/snapshot/ in the dataset’s root directory. Inside, you’ll find folders named after each snapshot. Simply copy the file you need from the snapshot folder back to its original location.
💾 Expert Note:
This hidden .zfs/snapshot/ directory is accessible over SMB or NFS shares if you enable the “snapshot directory” property. In TrueNAS, go to the dataset’s advanced options and set “Snapshot Directory” to “visible.” This makes recovering files from snapshots trivial for end users — they can browse and restore files themselves without needing admin access.
Snapshot + Replication as a Lightweight Backup Strategy
While snapshots alone aren’t backups, combining them with ZFS replication creates a powerful, efficient backup system. ZFS replication sends only the differences between snapshots to another pool — local or remote. This is far more efficient than rsync or file-level copy for large datasets.
How ZFS Replication Works with Snapshots
You create a snapshot on your primary pool, then replicate it to a secondary pool (or a remote TrueNAS system). The first replication sends the entire snapshot. Subsequent replications send only the changed blocks between the last snapshot and the current one. This incremental transfer is often 90-95% smaller than a full file copy.
For a homelab, this means you can replicate your critical data to a second NAS, a USB drive attached to your primary server, or even a cloud provider that supports ZFS replication (like rsync.net or Backblaze B2 via a ZFS-aware tool). The replication schedule typically runs daily or weekly, depending on how much data you can afford to lose.
Practical Setup:
Pair your hourly snapshot schedule with a daily replication task to a second pool. If your primary pool fails, you lose at most 24 hours of data. This is a “snapshot + replication” strategy that many homelabs use as their primary backup, often supplemented by a quarterly off-site backup for true disaster recovery.
Bottom Line: Which Snapshot Strategy Should You Choose?
For most TrueNAS homelab users, the answer is straightforward: set up hourly snapshots retained for 24 hours, daily snapshots kept for 7 days, and weekly snapshots kept for 4 weeks. This gives you a granular recovery window for common mistakes without consuming excessive pool space. Then, add daily ZFS replication to a second pool for backup.
If you are running a system with limited pool space (under 4 TB total), reduce the hourly retention to 12 hours and drop the weekly retention. If you have abundant storage (over 20 TB), consider adding monthly snapshots retained for 3 months for extra peace of mind. The key is to start with a conservative schedule and adjust based on your actual space usage after a month of operation.
Are ZFS snapshots the same as a backup?
No, ZFS snapshots are not a backup. A snapshot lives on the same physical pool as your active data. If the pool suffers hardware failure, power surge damage, or physical theft, the snapshots are lost along with your data. Snapshots protect against logical errors like accidental deletion, file corruption from software bugs, or ransomware encryption (if caught before the snapshots are deleted). A true backup must be on a separate pool, ideally in a different physical location. Use snapshots for rapid recovery from mistakes, and off-site backups for disaster recovery.
How much space do ZFS snapshots use?
Initially, a ZFS snapshot uses zero additional disk space because it shares data blocks with the live dataset. Space consumption begins only when data changes after the snapshot is taken. The space used equals the size of the blocks that have been modified or deleted since the snapshot was created. For a typical homelab dataset with moderate daily changes (10-20 GB per day), a schedule of hourly snapshots retained for 24 hours plus daily snapshots kept for 7 days usually consumes between 50-200 GB of pool space. You can monitor usage in TrueNAS under the dataset’s “Snapshots” tab, which shows the total space consumed by all snapshots for that dataset.
How do I schedule automatic snapshots in TrueNAS?
In TrueNAS, navigate to Tasks > Periodic Snapshot Tasks and click “Add.” Select the dataset you want to protect. Set the snapshot frequency (hourly, daily, weekly, monthly) and define the retention policy by specifying how many snapshots to keep for each frequency. TrueNAS automatically deletes old snapshots once the retention limit is reached. For most homelabs, a starting schedule of hourly snapshots retained for 24 hours, daily snapshots kept for 7 days, and weekly snapshots kept for 4 weeks works well. Enable the “Recursive” option if your dataset has sub-datasets you also want to protect.
Can a snapshot protect me from ransomware?
Yes, but only if the ransomware does not delete or encrypt the snapshots themselves. Many modern ransomware variants specifically target and delete Volume Shadow Copy snapshots on Windows, and some can also delete ZFS snapshots if they gain sufficient access. To protect against this, set snapshots to be read-only and ensure they are stored on a dataset that the application or user account accessing your files cannot modify. Additionally, replicate your snapshots to a separate pool or off-site location that does not have write access from your primary system. This replication strategy ensures you have a clean copy of your data even if the primary pool’s snapshots are compromised.
📋 Sources & Last Verified:
Last verified: July 09, 2026. Specifications cross-checked against TrueNAS documentation and ZFS on Linux/OpenZFS project documentation where available.
🛡 Shop Recommended Hardware
Prices and stock verified regularly by our affiliate partners. As an affiliate, HomeLabCost may earn a commission on qualifying purchases at no extra cost to you.
Browse Hardware Picks →
homelabcost
HomeLabCost editor covering NAS builds, hardware selection, and homelab server setup guides.