Start with who acts, when they act and what they need
User-driven historical access during configured retention.
Snowflake-assisted last-resort recovery after retention.
A new writable object sharing existing storage initially.
“Query yesterday’s data” and “UNDROP immediately” point to Time Travel. “Contact Snowflake after Time Travel expired” points to Fail-safe. “Create an isolated test environment quickly” points to cloning.
Time Travel: self-service historical access inside retention
When table data changes or an object is dropped, Snowflake preserves historical information for the applicable retention period. Authorized users can query a previous state, create a clone from that state, or restore supported dropped objects with UNDROP.
-- Inspect the table as it existed five minutes before a statement
SELECT *
FROM production.orders
BEFORE (STATEMENT => '01b12345-0000-0000-0000-000000000001');
-- Recover a dropped table during its Time Travel window
UNDROP TABLE production.orders;
-- Create an isolated recovery copy from a known timestamp
CREATE TABLE recovery.orders_check CLONE production.orders
AT (TIMESTAMP => '2026-08-18 09:00:00 +00:00'::TIMESTAMP_TZ);The precise retention available depends on account edition, object type and configuration. A permanent table can support longer retention on eligible editions; transient and temporary tables have reduced protection. Confirm current settings instead of assuming every object has the same window.
Use AT for a point or BEFORE for the moment before a statement or offset.
Restore a supported dropped object while its Time Travel data remains available.
Create a writable object from a retained past state without overwriting the source.
Historical data retained because of changes contributes to storage usage.
Fail-safe: a separate seven-day last-resort period
After the Time Travel retention period ends for a permanent table, its historical data enters a non-configurable seven-day Fail-safe period. Users cannot run historical queries or perform routine self-service restoration against Fail-safe data. Recovery is performed by Snowflake on a best-effort basis and may take time.
Operational recovery
- Configured retention
- User-accessible SQL features
- Historical query, clone and UNDROP
- Designed for normal recovery workflows
Disaster recovery service
- Fixed seven-day period
- Not directly accessible by users
- Requires Snowflake assistance
- Not a substitute for backup planning
Fail-safe applies to permanent tables, not transient or temporary tables. Reducing Time Travel retention does not turn Fail-safe into an immediate or user-controlled restore mechanism.
Zero-copy cloning: fast isolation without an initial full copy
A clone is a new object with independent metadata that initially references the same immutable micro-partitions as its source. Creating it is fast and does not duplicate all existing table storage at creation. As source and clone change, each references new micro-partitions and storage consumption grows.
Common uses include development, testing, recovery validation and branching data workflows. Cloning is not a live synchronization feature: later source changes do not appear automatically in the clone, and clone changes do not update the source.
When possible, clone the historical state first, validate row counts and business results in isolation, then apply a controlled repair. This preserves evidence and reduces the risk of an incorrect restore overwriting current data.
Permanent, transient and temporary tables trade recovery for cost
Do not choose transient solely because it reduces storage overhead. First prove that the data can be recreated within the recovery objective and that the absence of Fail-safe is acceptable.
Worked scenario: a faulty update changed 1.8 million orders
Situation: At 10:12 UTC, an update set the wrong status on recent orders. The table is permanent, Time Travel is enabled, and valid transactions continued afterward.
Stop the faulty writer
Prevent additional corruption and record the query ID, timestamp and affected table.
Query the prior state
Use BEFORE (STATEMENT) when the offending query ID is known, then compare keys and expected values.
Clone, validate, repair
Create a historical clone, validate it, and merge only the required corrections into the live table.
A full table replacement could discard legitimate changes made after 10:12. A targeted repair from a validated historical clone protects those later transactions. Fail-safe is not the first choice because the data remains inside Time Travel and self-service recovery is available.
When a historical query fails, check these in order
- Retention window: confirm the requested point is still within the object’s effective Time Travel period.
- Object identity: verify the database, schema and table, especially when similarly named clones exist.
- Reference type: validate the timestamp, offset or query ID and whether
ATorBEFOREmatches the intent. - Privileges: confirm the role has the access needed for the selected operation.
- Object type: check whether the table is permanent, transient or temporary and what protection it actually provides.
Recovery capability is determined before the incident by table type, retention configuration and operational procedures. Fail-safe cannot compensate for every design decision after the fact.
Practice checks with explanations
A team needs a writable copy of production for a one-day test without immediately duplicating 20 TB. What fits?
Best answer: a zero-copy clone. It initially shares immutable storage, then accumulates independent storage as data changes.
An administrator dropped a permanent table two hours ago and retention is active. What is the direct recovery feature?
Best answer: Time Travel through UNDROP TABLE. Do not wait for Fail-safe while self-service recovery remains available.
A transient staging table passed its Time Travel window. Can support recover it from Fail-safe?
Best answer: no. Transient tables have no Fail-safe period; recreate the staging data from its source or pipeline.
Common SnowPro Core mistakes
- Calling Fail-safe an extra Time Travel window that users can query.
- Assuming every table type receives seven days of Fail-safe.
- Treating a clone as continuously synchronized with its source.
- Assuming a zero-copy clone can never increase storage cost.
- Using a full restore when a targeted repair must preserve later valid changes.
- Hard-coding one retention value for every edition and object type.
- Choosing transient storage without confirming that the data is reproducible.
Frequently asked questions
What is the difference between Snowflake Time Travel and Fail-safe?
Time Travel is a configurable retention period for self-service historical queries, cloning and restoration. Fail-safe is a separate, non-configurable seven-day period for best-effort recovery by Snowflake after Time Travel ends; it is not directly queryable by users.
Is Fail-safe a replacement for backups?
No. Snowflake describes Fail-safe as a last-resort recovery service, not a user-accessible backup or a tool for routine historical access. Recovery requirements should be designed around Time Travel, replication and other appropriate controls.
Does a zero-copy clone immediately duplicate all table storage?
No. A clone initially shares existing micro-partitions with its source. Storage grows independently as either object changes and new or changed micro-partitions are created.
Can transient tables use Fail-safe?
No. Transient and temporary tables do not have a Fail-safe period. Their Time Travel retention is also limited compared with permanent tables, so use them only when reduced recovery protection matches the data's purpose.
Can I clone a table at a previous point in time?
Yes, when that point is still available in the source object's Time Travel retention. CREATE ... CLONE can use AT or BEFORE to create a writable object from the selected historical state.
Official Snowflake references
Review Snowflake’s current documentation for Time Travel, Fail-safe, cloning considerations, and the SnowPro Core COF-C03 certification. ITCertPath content is independent and does not reproduce confidential exam questions.