Synology Snapshots Explained: Complete 2026 Guide with Immutable Protection

Synology Snapshots provide instant point-in-time recovery for NAS data, protecting against accidental deletion, ransomware encryption, and file corruption. Unlike traditional backups that copy entire datasets, snapshots use Btrfs copy-on-write technology to track only the changes, making them near-instantaneous and storage-efficient.

Immutable Snapshots (WORM - Write Once, Read Many), available from DSM 7.2 on supported Synology models, add a second layer of protection. Once a snapshot is made immutable, Synology states it cannot be removed by any means until its protection period ends, so a compromised admin account cannot delete it. Synology recommends a protection period of 7 to 14 days.

This guide covers everything from basic snapshot configuration to advanced immutable protection and off-site replication strategies. If you're evaluating NAS options, see our Synology NAS Business Guide for model comparisons.

---

Key Takeaways

---

How Do Synology Snapshots Work?

Synology Snapshots use Btrfs copy-on-write technology to create point-in-time reference markers of your data. Unlike full backups, they take up near-zero storage space initially and only consume space when files are modified or deleted.

Under the hood, Synology Snapshots leverage the Btrfs file system's "Copy-on-Write" (CoW) architecture. When you create a snapshot, the NAS doesn't duplicate the data; it simply records the state of the metadata at that exact moment.

If you edit a 10GB video file, the system only saves the changed bits (deltas) rather than rewriting the entire 10GB. This makes snapshots near-instantaneous and extremely storage-efficient, allowing you to keep thousands of versions without overwhelming your drives.

Example: How CoW Works in Practice

• Initial snapshot: Records metadata only, so it uses very little space at first
• Edit 100MB of a 10GB file: Next snapshot stores only the 100MB delta
• Delete the file: Original data preserved in snapshot until retention expires
• Limits: Synology supports up to 1,024 snapshots per shared folder and 65,536 per system (shared folders and LUNs combined)

---

What Are Immutable Snapshots (WORM)?

Immutable Snapshots create a Write Once, Read Many (WORM) state that prevents deletion for a defined period, even by administrators. This is the primary defense against ransomware attacks that target backup systems.

Available from DSM 7.2, Immutable Snapshots address a specific weakness: ordinary snapshots can be deleted by anyone with admin privileges. When an attacker gains admin access (through credential theft or privilege escalation), a common pattern is to:

1. Delete snapshots and backups
2. Encrypt the live data
3. Demand ransom

How Immutability Blocks This Attack

With immutable snapshots configured for a 7-day protection period:

• Day 1: Ransomware infects the system and gains admin access
• Day 1: Attacker attempts to delete snapshots → BLOCKED by WORM protection
• Day 1: Attacker encrypts live data
• Day 1: You discover the attack and roll back to a snapshot from 2 hours ago
• Result: Data loss limited to changes made since that snapshot, and short downtime

Compliance & Enterprise Use

Synology positions its immutable storage features, including WriteOnce shared folders, as tools that can support data-retention and governance policies in regulated settings such as financial services (FINRA, SEC) and healthcare (HIPAA), and Synology describes its data-management tools as designed to simplify compliance with regulations such as the EU GDPR. Synology does not state that immutable snapshots on their own satisfy any of these rules, and compliance depends on how the whole system is configured and documented. If a regulation applies to you, confirm the requirements with your compliance adviser and review Synology's WriteOnce white paper.

---

How Do I Enable Synology Snapshots?

Install the "Snapshot Replication" package from the Package Center. Open the app, navigate to "Snapshots," select a Shared Folder, click "Settings," and check "Enable Snapshot Schedule." Ensure your volume is formatted as Btrfs.

Snapshots require the Snapshot Replication package, installed from Package Center on a model and volume that support it. If you're looking for a NAS with Btrfs support, the Synology DS925+ is a current 4-bay Plus-series model (listed as Generally Available on Synology's product status page as of October 27, 2026). The DS923+ is its predecessor; reseller sources report it as discontinued, so check availability before buying.

Step 1: Verify Prerequisites

1. Check File System: Ensure your volume uses Btrfs

   • Go to Control Panel > Storage Manager
   • Select your volume and verify "File System: Btrfs"
   • Shared folder snapshots do not work on EXT4 volumes
   • Critical: Migrating from EXT4 to Btrfs requires a full volume format (complete data wipe). You must backup all data first, format the volume as Btrfs, then restore. There is no in-place conversion.

2. Verify DSM Version and model: For immutable snapshots, you need DSM 7.2 or later and a Synology model that supports immutable snapshots

   • Go to Control Panel > Info Center
   • Check DSM version under "System"

Step 2: Install Snapshot Replication

1. Open Package Center
2. Search for "Snapshot Replication"
3. Click Install
4. Launch the app after installation

Step 3: Configure Snapshot Schedule

1. In Snapshot Replication, go to Snapshots tab
2. Select a Shared Folder from the list
3. Click Settings button
4. On the Schedule tab, check "Enable snapshot schedule" and set the time and interval
5. Under Retention, choose a policy: Smart Retention (Synology's Grandfather-Father-Son mechanism), the number of latest snapshots to keep, or keep all snapshots for a set number of days

Example Schedule Settings (suggested starting points, not Synology defaults):

Step 4: Enable Immutable Snapshots (CRITICAL)

1. In the same Settings window, stay on the Schedule tab
2. Check "Enable immutable snapshots"
3. Set the Protection period (Synology recommends 7 to 14 days)
4. Click OK to save and confirm the message that appears

You can also make an existing snapshot immutable: Snapshot > Snapshot List, select it, click Edit, and enable immutable snapshots.

Step 5: Make Snapshots Visible to Users (Optional)

This feature allows non-technical users to recover their own files without IT assistance:

1. In Settings > Advanced tab
2. Check "Make snapshot visible"
3. Snapshots then appear in a #snapshot folder inside the shared folder, reachable through file services

Users get read-only access, and only to snapshots taken after their account was created and granted read permission on the shared folder. Snapshots of encrypted shared folders cannot be browsed.

Storage Capacity Planning

Snapshot space use depends on how much data changes, so there is no fixed percentage. As a planning estimate, leave extra free space for snapshots, more for folders that change often (databases, VMs) and less for archives.

Synology provides an estimation tool: Snapshot Replication > Snapshots > select the shared folder > Snapshot > Calculate Size (minimum range of 7 days). Synology notes the result is an estimate.

For optimal snapshot performance, consider using enterprise-grade NAS drives like the Seagate IronWolf Pro 18TB or WD Red Pro 22TB, which are designed for 24/7 operation and handle Btrfs workloads efficiently.

---

How Can I Recover Files from a Snapshot?

Users can recover files via the #snapshot folder in Windows File Explorer or macOS Finder if "Make Snapshot Visible" is enabled. Administrators can perform full folder rollbacks using the Snapshot Replication app on the NAS.

You have three recovery options depending on the severity of the data loss:

Method 1: Self-Service Recovery (End Users)

If you enabled "Make snapshot visible" in the Advanced settings, users will see a #snapshot folder inside their network share.

Alternative: Browse from the NAS (Administrator)

In Snapshot Replication > Recovery, select the shared folder, click Recover, then Browse to view, download, or copy items from a snapshot without restoring the whole folder. This is useful for checking a snapshot before performing a full restore.

Windows Users:

1. Open File Explorer and navigate to your network share
   • Example: \\NAS-SERVER\Documents
2. You'll see a #snapshot folder at the top of the directory
3. Open #snapshot to see timestamped folders:

   #snapshot/
   ├── @GMT-2026.01.20-09.00.00/
   ├── @GMT-2026.01.20-10.00.00/
   ├── @GMT-2026.01.20-11.00.00/
   └── @GMT-2026.01.20-12.00.00/
   

4. Browse to the timestamp before the file was deleted/corrupted
5. Copy (not move) the file back to the live directory

Alternative: Windows Previous Versions

1. Right-click any folder in the network share
2. Select Properties > Previous Versions tab
3. Choose a restore point from the list
4. Click Restore or Open to browse

macOS Users:

1. Open Finder and connect to your NAS share
   • Go > Connect to Server (smb://NAS-SERVER)
2. Navigate to the shared folder
3. The #snapshot folder appears as a regular directory
4. Browse timestamped folders and copy files back

Method 2: Single File Restore (Administrator)

For users without direct snapshot access:

1. Open Snapshot Replication app
2. Go to the Recovery page and select the Shared Folder tab
3. Select the shared folder and click Recover
4. Select the snapshot timestamp
5. Click Browse to view, download, or copy the files you need
6. Copy the files back to the live folder (or download them)

Method 3: Full Folder Rollback (Disaster Recovery)

In the event of ransomware encryption or catastrophic corruption:

Safety Tip: Clone Before Restoring

Before performing a destructive rollback, you can clone a snapshot to a new shared folder to check the data:

1. In Snapshot Replication > Recovery, select the folder and click Recover, then pick the snapshot
2. Click Action > Clone with a new name instead of Restore to this snapshot
3. Follow the prompts in Control Panel to set up the new shared folder (e.g., "Documents_Recovery_Test")
4. Verify the cloned data is intact
5. Only then proceed with restoring the live folder

This helps avoid restoring a bad snapshot over your live data.

Full Rollback Procedure:

1. Open Snapshot Replication app
2. Go to the Recovery page and select the Shared Folder tab
3. Select the affected shared folder and click Recover
4. Select the snapshot timestamp (e.g., 1 hour before attack)
5. Click Action > Restore to this snapshot
6. WARNING: This returns the shared folder to that point in time, so changes made after the snapshot are lost

Not available for: home folders, WriteOnce shared folders, and storage spaces that are a replication destination.

Recovery Speed: Restoring to a snapshot relies on Btrfs snapshots rather than copying data back file by file, so it is typically much faster than a restore from backup. Synology does not publish restore times; actual time varies with folder size and system load.

---

Are Synology Snapshots the Same as Backups?

No. Snapshots are stored on the same volume as the original data and depend on the drive's health. Backups (via Hyper Backup) are independent copies stored on separate hardware or clouds. You need both for a 3-2-1 strategy.

Do not confuse snapshots with backups. If your RAID volume crashes or the physical NAS is destroyed by fire, your local snapshots are lost along with the data. Our RAID guide explains what a RAID volume does and does not protect against.

Snapshots vs. Backups Comparison

Verdict

Real-World Scenario Examples

Scenario 1: Accidental File Deletion

• Problem: User deletes critical spreadsheet at 2:00 PM
• Solution: Snapshot recovery from 1:00 PM snapshot
• Recovery Time: Typically seconds to minutes
• Why not backup? Backup runs at midnight, would lose 14 hours of work

Scenario 2: Ransomware Attack

• Problem: Ransomware encrypts data at 3:00 AM
• Solution: Immutable snapshot from 2:00 AM (attacker cannot delete due to WORM protection)
• Recovery Time: Typically minutes for a full folder restore
• Why not backup? Backup might not have run yet, or restore takes hours

Scenario 3: NAS Hardware Failure

• Problem: RAID controller fails, all volumes inaccessible
• Solution: Restore from Hyper Backup to replacement NAS
• Recovery Time: 4-8 hours (depending on data size)
• Why not snapshot? Snapshots are on the failed volume—completely inaccessible

Power Protection Recommendation: Protect your NAS from power-related failures with a quality UPS like the APC Smart-UPS 2200VA or CyberPower CP1500 to ensure graceful shutdowns during outages.

---

Snapshot Replication: Off-Site Protection

Snapshot Replication copies snapshots to a second Synology NAS (on-site or remote) for near-instant disaster recovery. Unlike Hyper Backup, which requires full restoration, replicated snapshots can be activated immediately if the primary NAS fails.

This suits businesses that need to restore service quickly after a NAS failure.

How Snapshot Replication Works

1. Initial Replication: Full copy of data to destination NAS (one-time, can take hours to weeks depending on data size and bandwidth)
2. Ongoing Replication: Only snapshot changes are transferred after the first sync
3. Failover: If the primary NAS fails, fail over services to the destination NAS
4. Re-protect: When the original source is reachable again, re-protect to replicate in the other direction (this overwrites data on the new destination with the new source). A switchover swaps roles manually at any time

Setup Requirements

• Two Synology NAS devices (both with Btrfs support) - Consider a DS925+ for the primary site and a DS923+ for the backup location
• Network connection between sites (VPN or a secure direct connection; port 5566 is used for Btrfs shared folders) - See our NordLayer Business VPN Review for secure site-to-site connectivity
• Snapshot Replication package on both devices
• Sufficient storage on destination NAS

Configuration Steps

1. On primary NAS, open Snapshot Replication
2. Go to Replication > Shared Folder and click Create
3. In the wizard, choose Synology Snapshot Replication and a local or remote destination
4. Enter destination NAS details:
   • IP address or hostname
   • Account credentials
5. Enable encrypted connections and confirm the destination server's certificate when prompted
6. Set the replication schedule (the minimum interval for shared folders is 5 minutes), and optionally enable immutable snapshots on the partner server
7. Finish the wizard

Replication vs. Hyper Backup

The 3-2-1 Backup Strategy with Snapshots

---

Final Thoughts

Synology Snapshots have evolved from a convenient "undo" feature into a useful layer of ransomware defense. Immutable Snapshots (WORM), available from DSM 7.2 on supported models, make it much harder for an attacker with admin access to destroy your recovery points, while the combination of local snapshots, replication, and cloud backups covers a wide range of data loss scenarios.

Key Implementation Checklist:

• ✅ Verify Btrfs file system on all volumes
• ✅ Update to DSM 7.2 or later (immutable snapshots also need a supported model)
• ✅ Enable snapshot schedules with GFS retention
• ✅ Enable Immutable Snapshots with a 7-14 day protection period
• ✅ Make snapshots visible for self-service recovery
• ✅ Configure replication to second NAS (if available)
• ✅ Set up Hyper Backup to cloud or external drive
• ✅ Test recovery procedures quarterly

For businesses managing critical data, the combination of immutable snapshots and off-site replication provides strong recovery options without a separate dedicated storage appliance.

Ready to implement a professional snapshot strategy? Our team can help you configure Synology snapshots, set up replication, and design a complete 3-2-1 backup architecture tailored to your business needs.

---

Related Resources

• Synology NAS Review: Business Guide – Complete Synology NAS buying guide
• UGREEN vs Synology NAS Comparison – Alternative NAS options
• iDrive Business Review – Cloud backup solution for the 3-2-1 strategy
• NordLayer Business VPN Review – Secure VPN for remote NAS replication
• Small Business Network Security Audit Guide – Protect your entire infrastructure