Why Time Travel enables data recovery in Snowflake - Visual Breakdown

Process Flow - Why Time Travel enables data recovery

Data Modified or Deleted

↓

Time Travel Keeps Snapshots

↓

User Queries Past Data

↓

Snowflake Retrieves Historical Data

↓

Data Recovered or Restored

When data changes or is deleted, Snowflake keeps snapshots. Users can query these snapshots to recover past data.

Execution Sample

Snowflake

SELECT * FROM my_table AT (OFFSET => -3600);
-- Retrieves data from 1 hour ago

This query fetches the state of 'my_table' as it was one hour before the current time.

Process Table

Step	Action	Data State	Result
1	Initial data inserted	Table has 100 rows	Data stored normally
2	Delete 20 rows	Table now has 80 rows	Rows removed from current view
3	Query with Time Travel for 1 hour ago	Table snapshot has 100 rows	Returns full 100 rows including deleted ones
4	Recover deleted rows by cloning or insert	Table restored to 100 rows	Data recovered successfully
5	Time Travel retention period ends	Snapshots expire	Historical data no longer accessible

💡 Time Travel data retention period ends, so older snapshots expire and cannot be queried.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	Final
Table Row Count	0	100	80	100	100
Time Travel Snapshots	None	Snapshot at insert	Snapshot after delete	Snapshot used for recovery	Snapshots expire after retention

Key Moments - 3 Insights

How can deleted data still be queried after deletion?

Because Snowflake keeps snapshots of data changes (see execution_table step 3), Time Travel allows querying past states even after deletion.

What happens when the Time Travel retention period ends?

Snapshots expire and historical data is no longer accessible (see execution_table step 5), so recovery is not possible after that.

Does Time Travel change the current data?

No, Time Travel only keeps historical snapshots; current data reflects the latest state (see execution_table step 2 vs step 3).

Visual Quiz - 3 Questions

Look at the execution_table, how many rows does the table have immediately after deletion (step 2)?

A 100 rows

B 80 rows

C 20 rows

D 0 rows

💡 Hint

Check the 'Data State' column at step 2 in the execution_table.

At which step does Snowflake retrieve historical data using Time Travel?

A Step 3

B Step 2

C Step 1

D Step 5

💡 Hint

Look for when the query uses Time Travel to access past data in the execution_table.

If the Time Travel retention period is extended, what changes in the execution_table?

A Snapshots expire sooner

B Current data row count increases

C Snapshots remain accessible longer

D Deleted rows are permanently removed immediately

💡 Hint

Refer to the 'exit_note' and step 5 about snapshot expiration.

Concept Snapshot

Snowflake Time Travel keeps snapshots of data changes.
Users can query past data states using time offsets.
This enables recovery of deleted or changed data.
Snapshots expire after a retention period.
Time Travel does not affect current data state.

Full Transcript

Snowflake's Time Travel feature stores snapshots of data whenever changes happen. When data is deleted or modified, these snapshots keep the previous versions safe. Users can query these snapshots by specifying a time offset, like one hour ago, to see the data as it was then. This allows recovering deleted rows or previous data states without restoring from backups. However, these snapshots only last for a set retention period. After that, the snapshots expire and the historical data is no longer accessible. Time Travel works by keeping historical data separate from the current data, so current queries see the latest state while Time Travel queries can access past states.

Practice

1. What is the main benefit of Snowflake's Time Travel feature?

easy

A. It automatically backs up data to an external system.

B. It speeds up query performance by caching results.

C. It encrypts data to enhance security.

D. It allows you to recover data from a previous point in time.

Solution

1. Step 1: Understand Time Travel purpose

   Time Travel lets you access data as it was at a past time, enabling recovery.

2. Step 2: Compare options

   Only recovering past data matches Time Travel's main benefit; others describe different features.

3. Final Answer:

   It allows you to recover data from a previous point in time. -> Option D

4. Quick Check:

   Time Travel = Data recovery [OK]

Hint: Time Travel means going back to old data states [OK]

Common Mistakes:

• Confusing Time Travel with backup or encryption
• Thinking it improves query speed
• Assuming it stores data outside Snowflake

2. Which SQL syntax correctly queries data from 2 hours ago using Time Travel?

easy

A. SELECT * FROM table BEFORE (TIMESTAMP => CURRENT_TIMESTAMP - INTERVAL '2' HOUR);

B. SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -2, CURRENT_TIMESTAMP));

C. SELECT * FROM table AT (OFFSET => -7200);

D. SELECT * FROM table FOR TIME TRAVEL 2 HOURS AGO;

Solution

1. Step 1: Recall correct Time Travel syntax

   Snowflake uses AT (TIMESTAMP => ...) to query past data.

2. Step 2: Analyze options

   SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -2, CURRENT_TIMESTAMP)); uses DATEADD to subtract 2 hours from current time correctly; others use invalid or unsupported syntax.

3. Final Answer:

   SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -2, CURRENT_TIMESTAMP)); -> Option B

4. Quick Check:

   Use AT (TIMESTAMP => ...) with DATEADD for past data [OK]

Hint: Use AT (TIMESTAMP => DATEADD(...)) to query past data [OK]

Common Mistakes:

• Using unsupported keywords like BEFORE or FOR TIME TRAVEL
• Incorrect interval syntax
• Using OFFSET with negative seconds (not valid)

3. Given the table users had a row deleted 1 hour ago, what will this query return?
SELECT * FROM users AT (TIMESTAMP => DATEADD(hour, -1, CURRENT_TIMESTAMP));

medium

A. The table data including the deleted row as it was 1 hour ago.

B. An error because Time Travel cannot query deleted rows.

C. Only the deleted row from 1 hour ago.

D. The table data as it is now, without the deleted row.

Solution

1. Step 1: Understand Time Travel query effect

   Querying with AT (TIMESTAMP => ...) shows data as it was at that time, including deleted rows.

2. Step 2: Interpret the query

   The query asks for data 1 hour ago, so it returns all rows including the deleted one.

3. Final Answer:

   The table data including the deleted row as it was 1 hour ago. -> Option A

4. Quick Check:

   Time Travel shows past data including deleted rows [OK]

Hint: Time Travel shows full past data, not just current state [OK]

Common Mistakes:

• Assuming deleted rows are inaccessible
• Expecting only deleted rows returned
• Thinking it causes query errors

4. You tried to restore a dropped table using Time Travel but got an error. What is a likely cause?

medium

A. The Time Travel retention period has expired for that table.

B. You used the wrong SQL syntax for Time Travel.

C. The table was never created in the first place.

D. Time Travel does not support restoring dropped tables.

Solution

1. Step 1: Recall Time Travel retention limits

   Time Travel keeps data only for a set retention period (default 1 day).

2. Step 2: Analyze error cause

   If retention expired, data cannot be recovered, causing errors when restoring dropped tables.

3. Final Answer:

   The Time Travel retention period has expired for that table. -> Option A

4. Quick Check:

   Expired retention blocks recovery [OK]

Hint: Check retention period before restoring dropped tables [OK]

Common Mistakes:

• Assuming Time Travel keeps data forever
• Blaming syntax errors without checking retention
• Thinking dropped tables can't be restored at all

5. You accidentally updated many rows in a table 3 hours ago and want to recover the original data. Your Time Travel retention is 24 hours. Which approach correctly recovers the data?

hard

A. Run INSERT INTO table SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -3, CURRENT_TIMESTAMP)); to overwrite current data.

B. Run DELETE FROM table WHERE update_time < DATEADD(hour, -3, CURRENT_TIMESTAMP); to undo changes.

C. Use CREATE TABLE new_table AS SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -3, CURRENT_TIMESTAMP)); and replace the original table after verification.

D. Restore the entire database to the state 3 hours ago using Time Travel.

Solution

1. Step 1: Understand safe recovery method

   Directly overwriting current data risks data loss; safer to create a new table snapshot first.

2. Step 2: Verify and replace

   Creating a new table from past data lets you verify before replacing the original table.

3. Step 3: Analyze other options

   Run INSERT INTO table SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -3, CURRENT_TIMESTAMP)); to overwrite current data risks duplicate data; C does not revert updates; D is not supported at database level.

4. Final Answer:

   Use CREATE TABLE new_table AS SELECT * FROM table AT (TIMESTAMP => DATEADD(hour, -3, CURRENT_TIMESTAMP)); and replace the original table after verification. -> Option C

5. Quick Check:

   Recover by snapshot then replace [OK]

Hint: Recover past data into new table before replacing [OK]

Common Mistakes:

• Overwriting current data without backup
• Trying unsupported database-wide restore
• Using DELETE to undo updates