Don’t count on your cloud snapshots for instant file recovery

Technical Briefing | 11/3/2026

You probably have an automated policy that snaps your EBS volumes or persistent disks every four hours. It is cheap, easy, and provides a nice warm fuzzy feeling. But I have seen too many engineers realize the hard way that a block-level snapshot is not a surgical tool. When a developer accidentally deletes a config file, you are suddenly looking at a multi-gigabyte restore operation just to pull out one 2KB text file.

Why mounting the whole disk is a trap

The standard move is to provision a new volume from the snapshot and attach it to a recovery instance. That is fine for a catastrophic loss, but it is absolute overkill for minor accidents. If you are doing this, you are wasting time spinning up instances and juggling block devices. Instead, you should be mounting the snapshot directly on your current host if the cloud provider API allows it, or better yet, using a secondary mount point for quick access. But even then, watch out for filesystem UUID collisions.

mount -o nouuid,ro /dev/xvdf1 /mnt/recovery_snapshot

• Always use the nouuid mount option to avoid conflicts with your production filesystem
• Keep the mount point read-only so you do not accidentally mutate your safety net
• Label your snapshots with the instance ID so you can actually find the right one when the pager goes off

When block level is the wrong abstraction

If you are strictly doing block-level snapshots, you are missing application-level consistency. If your database is writing to disk, that snapshot might be crash-consistent, but it is not necessarily what you want to restore from during a high-traffic period. Test your restores by actually booting from one once a quarter. If you have not seen the recovery process succeed from start to finish, you do not have a backup, you just have a collection of expensive bits sitting in a bucket.

Next time you script out your lifecycle policy, add a quick step that verifies the snapshot is actually readable. You will thank yourself when that late-night emergency turns into a five-minute file copy instead of a three-hour incident report.