An example operation may include one or more of recording, by a snapshot node, a plurality of snapshots of a key-value storage based on a plurality of delta offsets from an initial snapshot of the key-value storage, receiving, by the snapshot node, an audit request from an audit node that contains an audit time, generating, by the snapshot node, a current snapshot based on an aggregation of the snapshots from the plurality of the snapshots up to a time of a transaction closest to the audit time, and executing, by the snapshot node, a chaincode based on a delta offset of the current snapshot from the time of the transaction to the audit time to restore a snapshot at the audit time.