Why do Unix-like OS incremental & consolidating backup systems focus so much on filesystem backup as opposed to device backup?

Question

This question is a bit of a cross-platform one in the sense that it's probably best answered by people with extensive knowledge of both Windows and Unix-like OSes.

I run a mixed environment (Windows, Linux, and BSD.) I'm used to the Windows ecosystem paradigm of device backup, in which the entire device (except for BIOS) can be snapshotted online, backed up to an image from that snapshot, and then restored from that image in the future. Many such systems support file(system) recovery from the image too, so that the user can recover individual files from the image without restoring the entire image itself.

However (except for Veeam) the Unix-like backup systems I've encountered do filesystem backups instead and don't support online snapshot-based imaging (Snapper claims to, but it works out of the box only with thin-provisioned LVM and Btrfs.) I'm curious because I'm trying to decide whether I should keep looking for an online imaging solution or just learn how to deal with the filesystem backup paradigm.

Why is the status quo the case?

Answer 1

Creating snapshot's requires some sort of Copy-On-Write storage system to allow both the snapshot and live state to exist at the same time. On Windows this is done with NTFS's Shadow Copy feature. This is not a classical filesystem feature so the more "normal" filesytems in Unix don't provide it. Instead it is provided in the Volume Management layer of the stack like in LVM, or in filesystems which cross into the Volume Management layer like ZFS and BTRFS. It can also be layered on top of the filesystem in the case of version control like Git. It is in fact a well known operation to set an LVM snapshot and Dump the filesystem, or Tar the files, of a snapshot before deleting the snapshot and moving on.

The sheer number of options for system setup (and the relative ease of replicating a system from just its files) in Unix might be why backups are taken of individual FS's instead of the entire system. Not that it's impossible, a disk can still be dd'ed and tools may be used to create a VHD from it to use as a VM's hard disk for example. It's just easier to let the system owner have responsibility for knowing how their system works.