A method includes identifying a state of an application and taking a snapshot of application data. The method continues to generate a virtual filter input/output snapshot from I/O filter records for the snapshot. The filer records are generated by a filter driver that intercepts I/Os between the application and disks that store application data. The method further includes releasing the snapshot, resuming the application and performing a backup using the virtual filter I/O snapshot. Finally, the method triggers the filter driver to replace multiple filter driver records corresponding to the virtual filter I/O snapshot with data indicating the application data was backed up using the virtual filter I/O snapshot.