In one embodiment, a user or client device is connected to a distributed file system comprised of one or more physical nodes. The data on each of the physical nodes store metadata about files and directories within the file system. Some of the embodiments permit a user to take a snapshot of data stored on the file system. The snapshot may include a single file, a single directory, a plurality of files within a directory, a plurality of directories, a path on the file system that includes nested files and subdirectories, or more than one path on the file system that each includes nested files and directories. In one embodiment, previous versions of a file or directory are stored only in response to a request to modify the file or directory. The system creates and updates a snapshot tracking data structure which provides information regarding each file or directory governed by the snapshot that was modified or deleted after the snapshot was taken. The snapshot tracking data structure may be used by the system to perform functions related to the snapshot, including deleting the snapshot.