Time Jumping

Ideally, you should design a data preservation strategy in such a way that you only have to think about it once. A system snapshot is a popular component of the backup strategy for many organizations.

A snapshot copies the system state at a moment in time. Snapshots are very fast, so they don't tie up the system for long, but experts warn that a snapshot does not replace the need for a backup. Snapshots depend on pointers and other properties of the filesystem to preserve the system state, but if the underlying filesystem is damaged, you won't be able to restore the snapshot.

For many scenarios, however, a snapshot is a fast and easy way to bring the system back. If you make a change to your configuration or install a new driver and the system ceases to function, you can restore it to a previous state with a snapshot. Linux has several tools for creating system snapshots, including the uncomplicated Timeshift [1], as well as the command-line-only solutions CYA [2] and Snapper [3]. You can think of these Linux tools as similar to System Restore on Windows and Time Machine on macOS.

Timeshift was first released six years ago and has two options for creating snapshots in a graphical interface. If the installation of the operating system is based on a conventional filesystem, Timeshift relies on the powerful rsync protocol. In addition, the software also gives you the option of using Btrfs to handle snapshots. The operating system needs to support a layout with Btrfs subvolumes [4]. We tested both approaches.

Timeshift is available for RPM- or DEB-based operating systems, as well as for Arch Linux and its derivatives. The installation and setup are quite simple. If the distribution you are using does not offer a Timeshift package, use the distribution-independent installer [5] with the .run extension.

Configuration

After launching the application for the first time, go to the Settings menu for configuration. You will find five tabs: Type, Location, Schedule, Users, and Filters. First, you have to decide if you want to use rsync or Btrfs to create the snapshots; in the majority of cases, rsync is used.

In the Type tab, click on the arrow below the selection field to find information on both methods (Figure 1). Looking at the more conventional method with rsync first, Timeshift uses rsync to create snapshots in the form of copies of modified files and hard links [6] to unchanged files from previous snapshots. So only the first snapshot will match the data stored in it in terms of size; all the following snapshots are incremental.

Figure 1: In the Type tab, select RSYNC for all filesystems except Btrfs.

Following the rsync method, Timeshift creates its snapshots on the system drive by default. You should change this by selecting another internal or external disk with a Linux-style filesystem and sufficient space. This allows the system to be restored even if the system drive has been damaged or accidentally formatted.

LUKS and LVM

Timeshift can handle LUKS encrypted systems, even if you set them up with LVM. The software also supports UEFI, but requires the GRUB2 bootloader. Docker or other containers are not supported, nor are the directories of Ubuntu's Snap package management system, which reside below /dev/loop by default. Snapshots must also not be located on network drives or remote devices.

After selecting the desired method, proceed to the Location tab, where you specify the storage location (Figure 2). It must have enough free disk space. However, you can only calculate the space you need once you have determined how often you want to take snapshots and how many you want to keep.

Figure 2: The Location tab only shows you usable Linux partitions. If possible, you should specify a storage location other than the system and home partitions.

A test system that is updated daily occupies about 120GB of disk space after two years of operation. The initial snapshot weighs in at 55GB, and the system contains a total of seven snapshots. A system that is rarely updated or not used very often will probably require less space.

Next, the Schedule tab lets you define when to create snapshots and how many of them you want to keep for emergencies. You can choose between hourly, daily, weekly, and monthly snapshots (Figure 3). Timeshift fires up every hour and takes care of the upcoming tasks.

Figure 3: In the Schedule tab, you can define when Timeshift creates snapshots and how many it keeps.

Not Home

The Users tab lists the system users. This always includes root and one or more unprivileged users (Figure 4). This is where you decide if you want to include home directories in the snapshot, and which ones. The root home does not normally need to be saved.

Figure 4: The Users tab lists the system users and supports generic inclusion or exclusion of the home directories. Use the filters in the next tab to fine-tune the settings.

In the case of home directories for unprivileged users, you will want to back up the hidden files. Backing up the entire home directory would be counterproductive. If you had to restore an older snapshot, all the personal data would be overwritten with older variants when restoring the home directory. That's why it's better to use a traditional backup solution for this.

The last tab, Filters, influences the size of the snapshots. This is where you can decide to exclude file types, directories, and files from the snapshot. The preset filters result from the Users tab's settings. You can now decide on further candidates for exclusion (Figure 5).

Figure 5: The filters for precise exclusion of file types, folders, and directories have their own logic, which is not described in the documentation.

The protocols in /var/log are generally best excluded, as is /var/apt. There are also exclusion candidates among the hidden files in the home directory. In our case, this includes the extensive configuration files of the installed browsers, which are already included in the daily backup. Directories like dev/, proc/, sys/, media/, mnt/, tmp/, and run/ are automatically excluded. All other exclusions are shown in the Summary at the end.

Defining Filters

You have to think through your use of filters. Suppose you have selected the middle option (Include Hidden) for home under Users. Then Timeshift will only back up hidden files. However, you want to back up the /home/<User>/foo/ directory, apart from the bar/ subdirectory. Listing 1 shows the corresponding filter.

/home/User/
- /home/User/foo/bar/
+ /home/User/foo/ *

Logically speaking, the exclusion line actually belongs at the end. However, this would not work, because filters act on subsequent filters, but do not affect them retroactively. If the exclusion of bar/ was at the end of the list, it would still be backed up, since the filter /home/<User>/foo/ * already includes it, and it cannot be excluded retroactively.

Simple Btrfs

When using Timeshift with Btrfs, the configuration is even easier, because the snapshots generally end up on the system partition. In addition, a snapshot always covers the entire system, except for Home.

In the tabs Type, Location, Schedule, and Users, there is very little to configure. Type and Schedule are identical to the rsync configuration tabs. As the Location, Timeshift specifies the system partition as the default. In Users, you can include the home directory, and you can enable quota support [7] in Btrfs groups.

If you are wondering what the Wizard menu item does in addition to Settings, you are not the only one. The only difference besides the Summary at the end is the absence of the Filters menu item. Thus, the wizard seems to be intended for users who do not want to set filters.

First Tests

After completing the configuration, create an initial manual snapshot as a test in the main window. During the first few days, you will want to check whether Timeshift is working to your satisfaction (Figure 6).

Figure 6: Clicking on a snapshot lets you enter comments.

You should also start the tool as root once only in the terminal; this shows you all the available options. For example, timeline --list tells you about the method used, the storage location, and the individual snapshots. You should be familiar with this function if you need to perform a restore later without a graphical user interface.

Simply Restore

Timeshift uses a directory structure that matches the filesystem. Likewise, in the event of damage, the folder or file can be restored simply using copy and paste (Figure 7). When it comes to rolling back the entire system, this is done either from the active system with a subsequent reboot, from another installed distribution, or via a live medium.

Figure 7: Unlike some backup applications, Timeshift does not use a proprietary file format, but lets you manually restore individual files and directories.

If there are several installed distributions, the restore will be successful even from the neighboring system – provided that Timeshift can be installed on it. If the snapshots are not on the system disk, you could theoretically install a different distribution and, if you don't like it, then restore the old system using a live medium. All you have to do is adjust the UUID manually, as the partition has been formatted in the meantime.

On the Running System

To restore from the running system, select the snapshot you want to restore and click Restore in the menubar. In rsync, then select the target drive (Figure 8). You can also optionally adjust the bootloader in this case if the subsequent reboot fails with the default setting. For Btrfs, the source and target drives are normally identical.

Figure 8: In general, the defaults that Timeshift specifies for the target device are a good fit. Nevertheless, you should take a close look at them.

In the next window, Timeshift performs a test run and then lists all the files it will be restoring. If required, you can also search for packages here. The last window displays the partitions involved once again (Figure 9). Click Next here to start the recovery. To be on the safe side, you should close running applications beforehand.

Figure 9: The last window, before the restore starts, shows what happens when you press Next (in an example with Btrfs). After that, there's no going back.

If you start the process on the running system, a terminal opens to let Timeshift restore the files. Do not interrupt the operation in the terminal – this could cause irreparable damage to the installation. After the recovery is complete, the system automatically restarts, reboots the selected snapshot, and then displays the current state of the system.

From the Outside

If you restore the system from a remote system, Timeshift will display the progress graphically instead. When the process is complete, restart the system. If this does not work, test another snapshot or modify the bootloader accordingly. However, in our test, problems of this type did not occur in any case.

If you are using Timeshift with Btrfs, you can continue working immediately after the restore. The desired subvolume then changes to the default at the next restart. Restoring Btrfs snapshots only takes seconds, whereas rsync takes 10 minutes or more, depending on the data volume.

If you test rsync on a Btrfs system first before switching to Btrfs snapshots later, Timeshift will seem to remove the rsync configuration. However, this is only a visual glitch: As soon as you switch back to rsync, you will see that all the snapshots are still available.

Tests Passed

Timeshift passed our tests on various systems with rsync and Btrfs with flying colors. No matter whether default, encrypted, or LVM – recovery succeeded at the first attempt every time. In addition, I have been using Timeshift on a system for about two years without any trouble so far.

Having said this, Timeshift could be better documented. The developer's wiki on GitHub [8] is quite terse. It lacks not only an explanation of the filters, but also instructions for Btrfs on creating the required Ubuntu subvolume layout. Not all distributions install Btrfs with the @ and @home subvolumes. For example, openSUSE uses a completely different layout, which is oriented to Snapper and is not suitable for Timeshift. There is also no man page for Timeshift or, at least, no mention of the possibility to use the tool at the command line.

Conclusions and Outlook

It seems that Timeshift is tailored for Linux Mint users. You thus have to glean information about advanced use cases from the Internet. However, this does not detract from the high functionality of Timeshift.

As an extension, integration with the update and boot manager would be desirable, in the way openSUSE does this with Snapper. In addition, the way snapshots are presented could be more meaningful, so that you can view the status of the individual snapshots. Having said this, the integrated comment function does help here. For Btrfs, the grub-btrfs [9] script lets you provide snapshots with the boot manager.