Data storage system capable of presenting an image of a data store at a past time, the system comprising: - a storage management device comprising: a receiver for receiving a specification for a past time; and an I/O processor which processes I/O requests directed to one or more target units of storage in a data store, the I/O processor configured to perform a copy-on-write operation directed to a target unit of storage prior to overwriting the data stored in the target unit of storage, wherein the copied data is moved to a location in a time store unless the data that should be overwritten is already stored in the time store; - an indexing module for recording write requests processed by the I/O processor, the indexing module comprising a memory for storing - for each write request which is processed by the I/O processor - a record comprising: i) identification of at least one target unit of storage to which the write was directed; ii) locations, within the time store, of data previously stored in the target unit of storage to which the write was directed, which data previously stored in the at least one target unit of storage to which the write was directed was overwritten at the target unit of storage by the write request after the copy-on-write to the time store; and iii) a write time denoting a time at which a write request was received; - a mapping module using the records stored by the indexing module to map the current location of past data in the time store for the at least one target unit of storage at the specified past time, wherein the mapping is employed for each write request that occurred after the past time and before the time the map is first created and wherein the map includes pointers to locations of past data in the time store for the units of storage that have been the subject of a write request since the past time; and - an image generation module for presenting an image of the data store at the past time, at least in part based on the map as generated by the mapping module. - a storage management device comprising: a receiver for receiving a specification for a past time; and an I/O processor which processes I/O requests directed to one or more target units of storage in a data store, the I/O processor configured to perform a copy-on-write operation directed to a target unit of storage prior to overwriting the data stored in the target unit of storage, wherein the copied data is moved to a location in a time store unless the data that should be overwritten is already stored in the time store; - an indexing module for recording write requests processed by the I/O processor, the indexing module comprising a memory for storing - for each write request which is processed by the I/O processor - a record comprising: i) identification of at least one target unit of storage to which the write was directed; ii) locations, within the time store, of data previously stored in the target unit of storage to which the write was directed, which data previously stored in the at least one target unit of storage to which the write was directed was overwritten at the target unit of storage by the write request after the copy-on-write to the time store; and iii) a write time denoting a time at which a write request was received; i) identification of at least one target unit of storage to which the write was directed; ii) locations, within the time store, of data previously stored in the target unit of storage to which the write was directed, which data previously stored in the at least one target unit of storage to which the write was directed was overwritten at the target unit of storage by the write request after the copy-on-write to the time store; and iii) a write time denoting a time at which a write request was received; - a mapping module using the records stored by the indexing module to map the current location of past data in the time store for the at least one target unit of storage at the specified past time, wherein the mapping is employed for each write request that occurred after the past time and before the time the map is first created and wherein the map includes pointers to locations of past data in the time store for the units of storage that have been the subject of a write request since the past time; and - an image generation module for presenting an image of the data store at the past time, at least in part based on the map as generated by the mapping module.