Why Time Travel enables data recovery in Snowflake - Why It Works

Introduction

Sometimes data gets deleted or changed by mistake. Time Travel in Snowflake lets you go back to see or restore your data as it was before the change. This helps fix errors without losing important information.

When you accidentally delete rows or tables and want to get them back quickly.

When you want to compare current data with how it looked in the past.

When you need to recover data after a wrong update or overwrite.

When you want to audit changes by looking at previous versions of your data.

When you want to create a backup copy of data from a specific past time.

Commands

This command shows the data in 'my_table' as it was one hour ago. It helps you see past data before changes happened.

Terminal

SELECT * FROM my_table AT (OFFSET => -3600);

Expected Output

ID | NAME  | VALUE

1  | apple | 10

2  | orange| 20

3  | banana| 15

This command creates a new table 'my_table_restore' with data from before a specific statement that changed or deleted data. It recovers the old data safely.

Terminal

CREATE TABLE my_table_restore AS SELECT * FROM my_table BEFORE (STATEMENT => '12345-abcde-67890');

Expected Output

Table MY_TABLE_RESTORE successfully created.

If you accidentally dropped 'my_table', this command restores it from Time Travel within the allowed retention period.

Terminal

UNDROP TABLE my_table;

Expected Output

Table MY_TABLE successfully undropped.

Key Concept

If you remember nothing else from this pattern, remember: Time Travel lets you see and restore your data exactly as it was at a past time to fix mistakes.

Common Mistakes

Trying to recover data after the Time Travel retention period has expired.

Snowflake only keeps past data for a limited time (default 1 day, up to 90 days). After that, data cannot be recovered.

Act quickly to use Time Travel commands before the retention period ends.

Using incorrect syntax or wrong timestamps when querying past data.

This causes errors or returns no data because the system cannot find the requested past state.

Use valid OFFSET, TIMESTAMP, or STATEMENT identifiers exactly as Snowflake expects.

Summary

Use SELECT ... AT (OFFSET => -seconds) to view data as it was in the past.

Use CREATE TABLE ... BEFORE (STATEMENT => id) to restore data before a change.

Use UNDROP TABLE to recover a dropped table within the retention period.

Practice

1. What is the main benefit of Snowflake's Time Travel feature?

easy

A. It automatically backs up data to an external system.

B. It speeds up query performance by caching results.

C. It encrypts data to enhance security.

D. It allows you to recover data from a previous point in time.

Solution

1. Step 1: Understand Time Travel purpose

   Time Travel lets you access data as it was at a past time, enabling recovery.

2. Step 2: Compare options

   Only recovering past data matches Time Travel's main benefit; others describe different features.

3. Final Answer:

   It allows you to recover data from a previous point in time. -> Option D

4. Quick Check:

   Time Travel = Data recovery [OK]

Hint: Time Travel means going back to old data states [OK]

Common Mistakes:

• Confusing Time Travel with backup or encryption
• Thinking it improves query speed
• Assuming it stores data outside Snowflake

2. Which SQL syntax correctly queries data from 2 hours ago using Time Travel?

easy

A. SELECT * FROM table BEFORE (TIMESTAMP => CURRENT_TIMESTAMP - INTERVAL '2' HOUR);

B. SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -2, CURRENT_TIMESTAMP));

C. SELECT * FROM table AT (OFFSET => -7200);

D. SELECT * FROM table FOR TIME TRAVEL 2 HOURS AGO;

Solution

1. Step 1: Recall correct Time Travel syntax

   Snowflake uses AT (TIMESTAMP => ...) to query past data.

2. Step 2: Analyze options

   SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -2, CURRENT_TIMESTAMP)); uses DATEADD to subtract 2 hours from current time correctly; others use invalid or unsupported syntax.

3. Final Answer:

   SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -2, CURRENT_TIMESTAMP)); -> Option B

4. Quick Check:

   Use AT (TIMESTAMP => ...) with DATEADD for past data [OK]

Hint: Use AT (TIMESTAMP => DATEADD(...)) to query past data [OK]

Common Mistakes:

• Using unsupported keywords like BEFORE or FOR TIME TRAVEL
• Incorrect interval syntax
• Using OFFSET with negative seconds (not valid)

3. Given the table users had a row deleted 1 hour ago, what will this query return?
SELECT * FROM users AT (TIMESTAMP => DATEADD(hour, -1, CURRENT_TIMESTAMP));

medium

A. The table data including the deleted row as it was 1 hour ago.

B. An error because Time Travel cannot query deleted rows.

C. Only the deleted row from 1 hour ago.

D. The table data as it is now, without the deleted row.

Solution

1. Step 1: Understand Time Travel query effect

   Querying with AT (TIMESTAMP => ...) shows data as it was at that time, including deleted rows.

2. Step 2: Interpret the query

   The query asks for data 1 hour ago, so it returns all rows including the deleted one.

3. Final Answer:

   The table data including the deleted row as it was 1 hour ago. -> Option A

4. Quick Check:

   Time Travel shows past data including deleted rows [OK]

Hint: Time Travel shows full past data, not just current state [OK]

Common Mistakes:

• Assuming deleted rows are inaccessible
• Expecting only deleted rows returned
• Thinking it causes query errors

4. You tried to restore a dropped table using Time Travel but got an error. What is a likely cause?

medium

A. The Time Travel retention period has expired for that table.

B. You used the wrong SQL syntax for Time Travel.

C. The table was never created in the first place.

D. Time Travel does not support restoring dropped tables.

Solution

1. Step 1: Recall Time Travel retention limits

   Time Travel keeps data only for a set retention period (default 1 day).

2. Step 2: Analyze error cause

   If retention expired, data cannot be recovered, causing errors when restoring dropped tables.

3. Final Answer:

   The Time Travel retention period has expired for that table. -> Option A

4. Quick Check:

   Expired retention blocks recovery [OK]

Hint: Check retention period before restoring dropped tables [OK]

Common Mistakes:

• Assuming Time Travel keeps data forever
• Blaming syntax errors without checking retention
• Thinking dropped tables can't be restored at all

5. You accidentally updated many rows in a table 3 hours ago and want to recover the original data. Your Time Travel retention is 24 hours. Which approach correctly recovers the data?

hard

A. Run INSERT INTO table SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -3, CURRENT_TIMESTAMP)); to overwrite current data.

B. Run DELETE FROM table WHERE update_time < DATEADD(hour, -3, CURRENT_TIMESTAMP); to undo changes.

C. Use CREATE TABLE new_table AS SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -3, CURRENT_TIMESTAMP)); and replace the original table after verification.

D. Restore the entire database to the state 3 hours ago using Time Travel.

Solution

1. Step 1: Understand safe recovery method

   Directly overwriting current data risks data loss; safer to create a new table snapshot first.

2. Step 2: Verify and replace

   Creating a new table from past data lets you verify before replacing the original table.

3. Step 3: Analyze other options

   Run INSERT INTO table SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -3, CURRENT_TIMESTAMP)); to overwrite current data risks duplicate data; C does not revert updates; D is not supported at database level.

4. Final Answer:

   Use CREATE TABLE new_table AS SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -3, CURRENT_TIMESTAMP)); and replace the original table after verification. -> Option C

5. Quick Check:

   Recover by snapshot then replace [OK]

Hint: Recover past data into new table before replacing [OK]

Common Mistakes:

• Overwriting current data without backup
• Trying unsupported database-wide restore
• Using DELETE to undo updates