Snapshots Aren't Backups: Real Data Recovery Needs Testing

The Myth: Snapshots and Replication Are Backups

There's a dangerous misconception floating around the data center: that snapshots and replication are backups. It's wrong—dead wrong. We've seen it too many times: a team thinks they're covered because they have nightly snapshots and synchronous replication, then a ransomware attack hits, and they discover their snapshots were encrypted along with the primary data, or the corrupted data replicated to the offsite copy. The FBI's 2024 IC3 report shows ransomware complaints rose 9% from 2023, and it's the most pervasive threat to critical infrastructure (FBI IC3 2024 Internet Crime Report). Meanwhile, NIST SP 800-34 makes the point bluntly: high availability is not a substitute for backups because corruption can propagate through an HA system (NIST SP 800-34 Rev. 1). Snapshot vendors often sell them as backup, but Broadcom's own documentation states clearly that VMware snapshots are not backups—they're just a change log, and if the base disks are deleted, the snapshot files alone can't restore a VM (Broadcom KB). So what actually works?

Real data recovery—the kind that saves you after a ransomware attack or a corrupted database—requires a deliberate strategy built on offline or immutable copies and, above all, regular testing. CISA's data backup guidance pushes the 3-2-1 rule: three copies, two different media, one off-site. A modernized 3-2-1-1-0 adds one immutable or air-gapped copy and zero unverified backups (CISA). That last '0' is the kicker: an untested backup is just an assumption. NIST SP 800-209 recommends testing backups at least monthly for critical data and doing an end-to-end test restore to a sandbox for applications with strict restoration speed requirements (NIST SP 800-209). Let's compare two common approaches to see which one holds up.

The Contenders: Cloud Snapshots vs. Tape Offline Copies

We'll pit two very different recovery strategies head-to-head: cloud-based snapshots (using something like AWS Backup or RDS automated snapshots) and offline tape copies (LTO). These represent the two poles of how modern shops handle recovery. Cloud snapshots are convenient, automated, and fast to restore from; tape is clunky, slow, but truly offline. The criteria we care about: RPO/RTO, ransomware resilience, testing practicality, and cost.

Criteria That Decide the Winner

Let's dig into each criterion. RPO is the maximum acceptable data loss in time; RTO is how fast you must be back (NIST). Cloud snapshots win on RPO: AWS Backup continuous backups for S3 let you restore to any point in the last 35 days, and RDS automated snapshots are incremental after the first full snapshot (AWS Backup, Amazon RDS). That's a beautiful RPO of minutes. Tape, by nature, is a scheduled backup—your RPO is the last time you ran a tape job, often 24 hours. On RTO, cloud wins again. Restoring from S3 is a matter of minutes to hours; tape requires physically retrieving the cartridge, loading it, and reading—easily a day or more. So if you need fast recovery, cloud snapshots are your friend.

But ransomware resilience flips the script. The whole point of an offline copy is that an attacker can't reach it. LTO tape provides an inherent air gap because it's not connected to the network (LTO Program). Cloud snapshots, even if you use an immutable vault, are still online. If an attacker compromises your AWS credentials, they could potentially delete backups—or as NIST SP 800-209 warns, attackers target not just primary data but backups and copies, and may poison future backups gradually (NIST SP 800-209). CISA's 3-2-1-1-0 rule explicitly calls for an immutable or air-gapped copy, and tape is the classic air gap. So for true ransomware protection, tape wins.

Testing is where most strategies fall apart. NIST SP 800-209 recommends monthly test restores for critical data, but in practice, tape restores are rarely tested because it's a hassle. Cloud snapshots make testing trivial—you can spin up a sandbox and restore. That's a huge advantage. But beware: just because it's easy to test doesn't mean you do it. And if you never test, the tape's air gap doesn't matter because you won't know if the tape is readable. So the deciding factor isn't the technology—it's your discipline.

Quick tip: If you use cloud snapshots, enable S3 Versioning and set a lifecycle rule to expire old versions; otherwise storage costs can balloon as AWS Backup retains all versions (AWS S3 backup User Guide).

Who Should Choose What

If you're a small business with a handful of VMs and your main threat is accidental deletion or a simple disk failure, cloud snapshots are probably sufficient—provided you test them. The RTO is fast, and the cost is predictable. But if you're a hospital, a bank, or any organization that could be targeted by ransomware, you need an offline copy. The FBI IC3 report lists Akira, LockBit, and RansomHub as the top ransomware variants in 2024 (FBI IC3). These groups specifically hunt for backup repositories to delete or encrypt. An offline tape is your last line of defense. LTO-9 offers 18 TB native capacity per cartridge, and the LTO roadmap promises up to 1.44 PB per tape by LTO-14 (LTO Program). That's not ancient tech—it's evolving.

Still, tape isn't for everyone. The RTO is too long for mission-critical systems that need to be back in under an hour. NIST SP 800-34 says mission-critical systems often have an RTO under 1 hour and RPO under 5 minutes (NIST). Tape can't meet that. So the real answer is a hybrid: use cloud snapshots for fast recovery of critical data, and use tape or another offline medium for long-term retention and ransomware insurance.

What I'd Actually Do

Here's my recommendation, and I'm going to be blunt. If you rely solely on snapshots or replication, you're gambling. I'd implement a tiered strategy: For Tier 1 data (databases, user files), use AWS Backup with continuous backups to get a 35-day recovery window, and also take weekly LTO tapes and store them offsite. For Tier 2 data, daily cloud snapshots are fine. Most importantly, schedule a test restore of your critical systems every month—not just a file restore, but a full spin-up in a sandbox. NIST SP 800-209 says test at least monthly for critical data (NIST SP 800-209). That's the only way to know your backups work. And document your RPO and RTO for each tier—if you don't know them, you can't choose the right backup frequency. The 3-2-1-1-0 rule is your friend: three copies, two media, one offsite, one immutable or air-gapped, and zero unverified backups (CISA). Follow that, and you'll sleep better.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• FBI IC3 2024 Internet Crime Report - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• LTO Program - https://www.lto.org/newsbytes-september-2022/
• Broadcom KB - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html