How Hyper-V Snapshots Work

How do Hyper-V snapshots work?

Files are flexible, and this is why snapshots can be made of virtual machines – pass-through disks do not support snapshots. The default location for storing a snapshot is configured in the virtual machine settings. By default, the snapshots are stored in subfolder of the virtual machine’s folder called Snapshots. You can change this setting and you can move snapshots using Live Storage Migration.

The configuration of the virtual machine is stored in an XML. The contained settings are copied into an XML file in the Snapshots folder.  The running state of the virtual machine is also stored using BIN and VSV files.

Each virtual hard disk of the virtual machine is also treated by the snapshot.  This is done using a special kind of differential virtual hard disk called the advanced virtual hard disk (AVHD):

  • Each VHD file will become a parent to an AVHD file. The virtual machine will start using the AVHD file for reads and writes after the snapshot, and the VHD file for reads older than the snapshot.
  • Each VHDX file will become a parent to an AVHDX file. The virtual machine will start using the AVHDX file for reads and writes after the snapshot, and the VHDX file for reads older than the snapshot.

A virtual machine can be sent back in time by applying the snapshot – that is, by erasing the contents of the AVHD/X files. A snapshot can be deleted by merging the AVHD/X back into their parent VHD/X files.

Sponsored Content

Passwords Haven’t Disappeared Yet

123456. Qwerty. Iloveyou. No, these are not exercises for people who are brand new to typing. Shockingly, they are among the most common passwords that end users choose in 2021. Research has found that the average business user must manually type out, or copy/paste, the credentials to 154 websites per month. We repeatedly got one question that surprised us: “Why would I ever trust a third party with control of my network?

Hyper-V snapshots

Aren’t Snapshots Dangerous?

In one word: Yes – but all powerful tools can be dangerous if misused. You must ensure that the guest applications in the virtual machine support snapshots and you must understand that you can delete data by applying a snapshot to a virtual machine.

Like with differential virtual hard disks, a snapshot should not be a short-term solution. Once created, all writes will go into the VHD/X files. This can lead to unplanned storage consumption. The physical LUN that stores virtual machines can fill. If this happens, Hyper-V will protect virtual machines that are stored on that LUN by pausing them.

There are several deadly mistakes that one can make with snapshots:

  • Swap the parent VHD/X files: There is a link between the AVHD/X and the VHD/X file. Do not attempt to break and recreate this link.
  • Delete the VHD/X files: Data older than the snapshot, such as the guest operating system, are stored in the parent disks. Do not delete the virtual hard disks.
  • Delete the AVHD/X files: Doing this will delete all the data of the virtual machine since the snapshot was created. Do not do this.
  • Leave a snapshot in place for a long time: Differential disks, and therefore AVHD/X files, is intended for short-term usage. Performance will degrade over time, and the files will continue to grow over time.

The final issue was resolved in Windows Server 2012 Hyper-V. In versions of Hyper-V, deleting a snapshot was not enough – you also needed to shut down the virtual machine to allow Hyper-V to merge the AVHD/X files back into the parent VHD/X files. Live snapshot merging is a feature of Windows 8 Client Hyper-V and Windows Server 2012 Hyper-V. The merge may not be immediate, but it will happen within a few minutes of the snapshot being deleted, and it will happen without shutting down the virtual machine.


Related Topics:

Aidan Finn, Microsoft Most Valuable Professional (MVP), has been working in IT since 1996. He has worked as a consultant and administrator for the likes of Innofactor Norway, Amdahl DMR, Fujitsu, Barclays and Hypo Real Estate Bank International where he dealt with large and complex IT infrastructures and MicroWarehouse Ltd. where he worked with Microsoft partners in the small/medium business space.
13 Email Threat Types to Know About Right Now

As email threats evolve and multiply, keeping track of them all—and staying protected against the many different types—becomes a complex challenge. Today, that requires more than just the traditional email gateway solution that used to be good enough.

In this eBook you will learn:

  • What are the most common and challenging email attacks for organizations?
  • How to defend against sophisticated email threats, such as spoofing, social engineering, and fraud
  • How to protect employees at the inbox level with the right technologies and security-awareness training
  • How to use a multilayered protection strategy to reduce susceptibility to email attacks and better defend your business and employees

Sponsored by: