A method, apparatus, and computer instructions for managing data in a file system in a data processing system. A request to modify a data block in the file system is detected during file system recovery time. In response to detecting the request, metadata is written to describe the data block into a snapshot image. The data is copied for the data block in the file system to the snapshot image. The data block is modified in the file system after the data is copied into the snapshot image. The snapshot image may be used to return the file system to a state prior to modifying the data block in the file system.