A primary computer system has a database, application programs that modify the local database, and a transaction manager that stores audit records in a local image trail reflecting those application program modifications to the local database. In a remote backup system, a Receiver process receives audit records from the primary system. The audit records include audit update and audit backout records indicating database updates and database backouts generated by transactions executing on the primary system. The Receiver stores the audit update and audit backout records in one or more image trails. For each image trail there is an Updater process that applies to a backup database volume the database updates and backouts indicated by the audit update and audit backout records in the image trail. The audit update and audit backout records are applied to the backup database volume in same order that they are stored in the image trail, without regard to whether corresponding transactions in the primary system committed or aborted. Upon the occurrence of a predefined event, such as failure of the primary system, the backup system determines a set of primary system transactions for which a commit/abort outcome is unknown. For each image trail, the corresponding Updater completes applying database updates and backouts to the backup database volume. Then, the Updater backs out database updates for the transactions for which the commit/abort outcome has been determined to be unknown.