A number of people have been asking me how snapshots actually work “under the covers”. So here we go: When you take a snapshot of a running virtual machine:
- We pause the virtual machine.
- We create a new differencing disk for each virtual hard disk and hook it up to the virtual machine.
- We make a copy of the virtual machine’s configuration file.
- We resume the virtual machine (note that this happens so quickly that you do not know that the virtual machine was paused at all.
- Once the virtual machine is running again we start saving the contents of the virtual machine’s memory to disk.
- While this is happening we monitor memory activity inside the virtual machine and if the the guest operating system attempts to modify memory that we have not copied, we intercept the write attempt and copy the original memory contents then allow the write to go through.
Once the snapshot is completed we have a set of the virtual machine configuration file, the virtual machine saved state files and the snapshot differencing disks (.AVHDs) stored in a folder under the virtual machine’s snapshot directory.
This is now treated as a read-only “point in time” image of a virtual machine. You can apply a virtual machine, in which case we set the virtual machine to start from a copy of the snapshot. You can change the virtual machine settings after applying a snapshot – but you cannot change the snapshot settings themselves.
You can also delete a snapshot. If you delete a snapshot that has no descendants (snapshot with differencing disks that reference the snapshot being deleted) then the files associated with the snapshot will just be deleted. If you delete a snapshot with only one descendant the configuration and saved state files for the snapshot will be deleted and the snapshot differencing disks will be merged with those of it’s descendant. If you delete a snapshot with more than one descendant the snapshot configuration and saved state files will be deleted – but the differencing disks will not be merged until the number of descendant snapshots is reduced to one.