Snapshot

Snapshots on ZFS or Btrfs are near-instant and space-efficient because they only track changes. They're perfect for recovering from mistakes or ransomware, but because they live on the same pool they are not a substitute for offsite backups.

The practical workflow is to schedule snapshots at multiple frequencies — for example hourly, daily and weekly, kept for decreasing lengths of time — using a tool like sanoid. That way you can browse or roll back to almost any recent point in seconds after an accidental deletion or a bad update. To turn snapshots into real backups, replicate them to another machine with ZFS send/receive (or Btrfs send); a snapshot copied to a separate system, ideally offsite, gives you both instant local recovery and disaster protection.