In one example, a method may include generating, by a computing device, a volume as a file in memory, where the volume may be based on an operating system (OS) image. The method may include attaching the file to a workload, booting the workload using the OS image, generating a version of the file with at least one block that underwent change and metadata associated with the change based on an input/output request to the volume, storing, by the computing device, the file and the version of the file on a storage device associated with the computing device, and recovering a version of the volume associated with the workload using the file and the version of the file stored in the storage device.