Simple definition
A snapshot preserves a reference state of a virtual machine or storage volume so that some changes can be rolled back. It is useful before a risky modification or software update. Unlike an independent backup, a snapshot often depends on the VM's original storage and therefore cannot protect against total loss of that storage.
Technical definition
On many VM platforms, writes after snapshot creation are redirected into delta disks or block-tracking structures. The original disk and the chain of modifications are required to reconstruct the selected state. Storage systems may instead use copy-on-write or redirect-on-write mechanisms. Whether memory state or application-consistent data is included depends on the product and the selected options.
- VM disk Original reference state
- Snapshot point Captured reference
- Delta writes Subsequent changes
- Disk chain Linked dependencies
- Consolidation Controlled disk merge
A snapshot is not always an independent copy. The exact mechanism and consolidation steps depend on the hypervisor.
What is it used for ?
Create a short-lived rollback point before maintenance, help with controlled changes or provide an intermediate mechanism used by virtualization-aware backup applications. A snapshot is not intended as a permanent archive or as protection from host failure.
Practical example
Before updating an application on a Windows VM, an administrator creates a temporary snapshot, checks the datastore's free space, performs the update and deletes the snapshot once everything is verified. Rolling back after a failure can also undo legitimate changes made since the snapshot, so the implications must be assessed.
Common issues
- Large delta disks growing until the datastore runs out of space.
- Long snapshot chains that complicate consolidation and troubleshooting.
- Rollback losing valid changes performed after snapshot creation.
- Inconsistent transactional application state when quiescing was not performed appropriately.
- Interrupted consolidation or deletion caused by insufficient capacity or storage errors.
Delta disks, copy-on-write and redirect-on-write
A snapshot is not necessarily a complete standalone disk copy. Many hypervisors preserve a reference point and record subsequent disk changes in a separate file or tracking structure. Storage systems can protect old blocks before overwrites (copy-on-write), or redirect new data to other blocks (redirect-on-write). The implementation differs between platforms.
As workloads change data, their snapshot structures may grow significantly. With several snapshots in a chain, consistency matters: manually removing disk files outside supported management tools can render virtual disks unusable.
Memory state and application consistency
A disk snapshot taken while a VM is running may only offer crash-consistent data or filesystem-level consistency. Transactional systems such as databases can require quiescing or coordination with mechanisms such as Windows Volume Shadow Copy Service (VSS).
Some hypervisors can also capture VM memory and execution state, increasing storage requirements. This does not make the snapshot equivalent to a verified application-aware backup.
Why snapshots differ from backups and replicas
A snapshot is mainly for nearby rollback. A backup stores independent recovery points under a retention policy. Replication maintains a secondary version for business continuity or disaster recovery. Deletion, data corruption and ransomware can affect original storage and its local snapshots together.
For critical workloads, use separate backup repositories and test recovery. Keep VM snapshots only for the necessary maintenance window and consolidate or remove them in line with vendor guidance.
Related terms
Key takeaway: a snapshot is a usually short-lived reference state that can depend on original storage. It helps rollback but cannot replace an independently stored, tested backup.