Ideally, you should design a data preservation strategy in such a way that you only have to think about it once. A system snapshot is a popular component of the backup strategy for many organizations.

A snapshot copies the system state at a moment in time. Snapshots are very fast, so they don't tie up the system for long, but experts warn that a snapshot does not replace the need for a backup. Snapshots depend on pointers and other properties of the filesystem to preserve the system state, but if the underlying filesystem is damaged, you won't be able to restore the snapshot.

For many scenarios, however, a snapshot is a fast and easy way to bring the system back. If you make a change to your configuration or install a new driver and the system ceases to function, you can restore it to a previous state with a snapshot. Linux has several tools for creating system snapshots, including the uncomplicated Timeshift [1], as well as the command-line-only solutions CYA [2] and Snapper [3]. You can think of these Linux tools as similar to System Restore on Windows and Time Machine on macOS.

Timeshift was first released six years ago and has two options for creating snapshots in a graphical interface. If the installation of the operating system is based on a conventional filesystem, Timeshift relies on the powerful rsync protocol. In addition, the software also gives you the option of using Btrfs to handle snapshots. The operating system needs to support a layout with Btrfs subvolumes [4]. We tested both approaches.

Timeshift is available for RPM- or DEB-based operating systems, as well as for Arch Linux and its derivatives. The installation and setup are quite simple. If the distribution you are using does not offer a Timeshift package, use the distribution-independent installer [5] with the .run extension.

Configuration

After launching the application for the first time, go to the Settings menu for configuration. You will find five tabs: Type, Location, Schedule, Users, and Filters. First, you have to decide if you want to use rsync or Btrfs to create the snapshots; in the majority of cases, rsync is used.

In the Type tab, click on the arrow below the selection field to find information on both methods (Figure 1). Looking at the more conventional method with rsync first, Timeshift uses rsync to create snapshots in the form of copies of modified files and hard links [6] to unchanged files from previous snapshots. So only the first snapshot will match the data stored in it in terms of size; all the following snapshots are incremental.

Figure 1: In the Type tab, select RSYNC for all filesystems except Btrfs.

Following the rsync method, Timeshift creates its snapshots on the system drive by default. You should change this by selecting another internal or external disk with a Linux-style filesystem and sufficient space. This allows the system to be restored even if the system drive has been damaged or accidentally formatted.

LUKS and LVM

Timeshift can handle LUKS encrypted systems, even if you set them up with LVM. The software also supports UEFI, but requires the GRUB2 bootloader. Docker or other containers are not supported, nor are the directories of Ubuntu's Snap package management system, which reside below /dev/loop by default. Snapshots must also not be located on network drives or remote devices.

After selecting the desired method, proceed to the Location tab, where you specify the storage location (Figure 2). It must have enough free disk space. However, you can only calculate the space you need once you have determined how often you want to take snapshots and how many you want to keep.

Figure 2: The Location tab only shows you usable Linux partitions. If possible, you should specify a storage location other than the system and home partitions.

A test system that is updated daily occupies about 120GB of disk space after two years of operation. The initial snapshot weighs in at 55GB, and the system contains a total of seven snapshots. A system that is rarely updated or not used very often will probably require less space.

Next, the Schedule tab lets you define when to create snapshots and how many of them you want to keep for emergencies. You can choose between hourly, daily, weekly, and monthly snapshots (Figure 3). Timeshift fires up every hour and takes care of the upcoming tasks.

Figure 3: In the Schedule tab, you can define when Timeshift creates snapshots and how many it keeps.

Not Home

The Users tab lists the system users. This always includes root and one or more unprivileged users (Figure 4). This is where you decide if you want to include home directories in the snapshot, and which ones. The root home does not normally need to be saved.

Figure 4: The Users tab lists the system users and supports generic inclusion or exclusion of the home directories. Use the filters in the next tab to fine-tune the settings.

In the case of home directories for unprivileged users, you will want to back up the hidden files. Backing up the entire home directory would be counterproductive. If you had to restore an older snapshot, all the personal data would be overwritten with older variants when restoring the home directory. That's why it's better to use a traditional backup solution for this.

The last tab, Filters, influences the size of the snapshots. This is where you can decide to exclude file types, directories, and files from the snapshot. The preset filters result from the Users tab's settings. You can now decide on further candidates for exclusion (Figure 5).

Figure 5: The filters for precise exclusion of file types, folders, and directories have their own logic, which is not described in the documentation.

The protocols in /var/log are generally best excluded, as is /var/apt. There are also exclusion candidates among the hidden files in the home directory. In our case, this includes the extensive configuration files of the installed browsers, which are already included in the daily backup. Directories like dev/, proc/, sys/, media/, mnt/, tmp/, and run/ are automatically excluded. All other exclusions are shown in the Summary at the end.