Various examples are directed to systems and methods for backing up data. A tracking utility may receive a start request and then enter a holding mode until a first modifiable or writable snapshot is created. The tracking utility can track such a first snapshot and determine if any modifications such as writes have been made to the first snapshot. If the first snapshot has not been modified it can be backed up using a read only snapshot scheme. If the first snapshot has been modified, a record of the modifications thereto are used to update the frozen changes and the current changes. The resulting or finalized snapshot is generated and includes all of the modifications, modifications 1 to N made to the first snapshot. This process can be repeated for one or more or all of the modifiable or writable snapshots.