Snapshots vs. Tape: Which Backup Recovers Best?

Imagine you're the IT admin at a mid-sized firm. It's 2 a.m., and the ransomware alert just fired. Your primary storage is encrypted, and the attackers left a note. You reach for your recovery plan. Do you have a backup that's actually restorable? Or just snapshots that are as dead as the source? This is the moment your backup strategy gets graded.

Here's the blunt truth: snapshots are not backups. Tape is a backup, but it's slow. Cloud backups are a middle ground. The right choice depends on your recovery point objective (RPO) and recovery time objective (RTO). And if you haven't defined those, you're flying blind.

In this head-to-head, I'm comparing three recovery options: VM snapshots, LTO tape, and AWS Backup for S3. I'll judge them on RPO, RTO, ransomware resistance, and cost. My recommendation, stated upfront: use tape or immutable cloud for your final safety net, and treat snapshots as a convenience, not a recovery plan.

RPO and RTO: The Metrics That Matter

Before you pick a backup method, you need to know your numbers. RPO is the maximum acceptable data loss, measured in time. If your RPO is five minutes, you can't afford to lose more than five minutes of changes. RTO is the maximum acceptable downtime. If your RTO is two hours, you must be back online within two hours. (NIST SP 800-34 defines these precisely.)

Mission-critical systems often get an RPO under 5 minutes and an RTO under 1 hour. Less critical systems can tolerate longer windows. (NIST)

Here's the kicker: your backup method must be able to meet those numbers. Snapshots can give you near-zero RPO if taken frequently. Tape cannot. But tape gives you an air gap that snapshots can't match.

Snapshots: Fast, But Not a Backup

Snapshots are point-in-time copies that use pointers, so they're created quickly and use little storage initially. (Backup terminology) But here's the catch: if the source data is unavailable, the snapshots are often unusable too, because they depend on the original storage. (NIST SP 800-209)

VMware is explicit: snapshots are not backups. A snapshot is just a change log of the original virtual disk. If you delete the base disk, the snapshot won't restore your VM. (Broadcom KB) Also, don't keep a snapshot for more than 72 hours, because the delta file grows and can fill your storage. (Broadcom KB) Maximum 32 snapshots in a chain, but they recommend only 2 to 3 for performance. (Broadcom KB)

So snapshots are great for quick rollbacks before a patch, but they're not your disaster recovery. That doesn't mean they're useless. For cloud, CISA advises taking snapshots of volumes for forensic review during a ransomware incident. (CISA ransomware checklist) But forensics aren't recovery.

Quick tip: Use snapshots for short-term recovery (hours to a few days), but never as your only copy. They're a convenience, not a backup.

Tape: Slow, But Air-Gapped

LTO tape is the old-school hero. LTO-9 offers 45 TB compressed per cartridge, hardware encryption, and WORM (Write-Once, Read-Many) functionality. (LTO Program) The air gap is inherent: tape is offline, so ransomware can't reach it. The LTO Program notes that disk is not offline and is not completely secured from ransomware. (LTO Program)

But tape is slow to recover. Restoring from tape can take hours or days, which violates a strict RTO. That's why tape is best for long-term retention and as a last-resort copy, not for rapid recovery.

For ransomware, the air gap is gold. An immutable or air-gapped copy is the '1' in the 3-2-1-1-0 rule, which adds one immutable or air-gapped copy and zero unverified backups. (CISA) Tape gives you that air gap without relying on cloud immutability settings.

Cloud Backup: The Middle Ground

AWS Backup for S3 offers continuous backups with point-in-time restore to any second in the last 35 days. That's a tight RPO. It also offers periodic snapshots with retention up to 99 years. (AWS) The first backup is full, subsequent are incremental. (AWS) For big buckets, backup rates can reach 17,000 objects per second during the initial full backup. (AWS)

But cloud backups aren't automatically air-gapped. You need to configure immutability and access controls. Also, if your AWS account is compromised, your backups could be deleted unless you've locked them down. So cloud is convenient, but you must enforce immutability.

Ransomware is a real threat: the FBI's IC3 received 2,705 ransomware complaints in 2024, with reported losses over $12 million. (FBI IC3 2024) And the FBI says losses are undercounted because they don't include lost business or remediation costs. (FBI IC3 2024) So you need a backup that can't be encrypted.

Head-to-Head Comparison

Which Wins?

There's no single winner. For rapid recovery, cloud or snapshots beat tape. For ransomware immunity, tape wins outright. The smart play is a tiered approach: use cloud or disk for fast recovery, tape for long-term archival, and never rely on snapshots alone.

Here's a concrete scenario: You run a small law firm. Your RPO is 15 minutes, your RTO is 4 hours. AWS Backup continuous restore gives you a 15-minute RPO, and you can restore an S3 bucket in under an hour. But you also keep a weekly tape backup in a safe deposit box, just in case your cloud account is hijacked. That's the 3-2-1 rule in action: 3 copies, 2 media, 1 offsite. (CISA)

Don't forget testing. CISA says to regularly test your backups. (CISA) NIST recommends at least monthly tests for critical data. (NIST SP 800-209) An untested backup is just a hope.

My specific recommendation: if you store any data that would kill your business if lost, buy an LTO drive and start a tape rotation. Yes, it's old-school, but ransomware doesn't care about cool. The air gap is your best insurance.

Sources

• CISA - StopRansomware Guide: https://www.cisa.gov/stopransomware
• NIST SP 800-34 Rev. 1: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• NIST SP 800-209: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• Broadcom KB - VMware snapshot best practices: https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• AWS Backup - S3 backups: https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html
• LTO Program - NewsBytes September 2022: https://www.lto.org/newsbytes-september-2022/