A number of people have been asking me how snapshots actually work "under the covers". So here we go: When you take a snapshot of a running virtual machine:
- We pause the virtual machine.
- We create a new differencing disk for each virtual hard disk and hook it up to the virtual machine.
- We make a copy of the virtual machine's configuration file.
- We resume the virtual machine (note that this happens so quickly that you do not know that the virtual machine was paused at all.
- Once the virtual machine is running again we start saving the contents of the virtual machine's memory to disk.
- While this is happening we monitor memory activity inside the virtual machine and if the the guest operating system attempts to modify memory that we have not copied, we intercept the write attempt and copy the original memory contents then allow the write to go through.
Once the snapshot is completed we have a set of the virtual machine configuration file, the virtual machine saved state files and the snapshot differencing disks (.AVHDs) stored in a folder under the virtual machine's snapshot directory.
Windows Server 2008, Hyper-V, SnapShot, Virtualization