Virtual Machine Snapshotting under Hyper-V

Virtual Machine Snapshotting under Hyper-V

Rate This
  • Comments 19

A number of people have been asking me how snapshots actually work "under the covers". So here we go: When you take a snapshot of a running virtual machine:

  • We pause the virtual machine.
  • We create a new differencing disk for each virtual hard disk and hook it up to the virtual machine.
  • We make a copy of the virtual machine's configuration file.
  • We resume the virtual machine (note that this happens so quickly that you do not know that the virtual machine was paused at all.
  • Once the virtual machine is running again we start saving the contents of the virtual machine's memory to disk.
  • While this is happening we monitor memory activity inside the virtual machine and if the the guest operating system attempts to modify memory that we have not copied, we intercept the write attempt and copy the original memory contents then allow the write to go through.

Once the snapshot is completed we have a set of the virtual machine configuration file, the virtual machine saved state files and the snapshot differencing disks (.AVHDs) stored in a folder under the virtual machine's snapshot directory.

This is now treated as a read-only "point in time" image of a virtual machine.  You can apply a virtual machine, in which case we set the virtual machine to start from a copy of the snapshot.  You can change the virtual machine settings after applying a snapshot - but you cannot change the snapshot settings themselves.

You can also delete a snapshot.  If you delete a snapshot that has no descendants (snapshot with differencing disks that reference the snapshot being deleted) then the files associated with the snapshot will just be deleted.  If you delete a snapshot with only one descendant the configuration and saved state files for the snapshot will be deleted and the snapshot differencing disks will be merged with those of it's descendant.  If you delete a snapshot with more than one descendant the snapshot configuration and saved state files will be deleted - but the differencing disks will not be merged until the number of descendant snapshots is reduced to one.


Leave a Comment
  • Please add 6 and 7 and type the answer here:
  • Post
  • A question with snapshot technology.   This is more "trivia" than complaint.

    Shadow Copy



    All are limited to 64 entries.   Is this a present limit to all three or just an "arbitrary" number than can be changed in the registry?


    BTW Just DYING to see the release of Hyper-V.  Can't wait to get drivers for Vista and others in there!

    Excellent job on it so far Microsoft, keep up the good work!

  • Great article, Ben, as usual!

    On a side note, I published an article, "Getting Networking to Work on Hyper-V," referencing your article on Hyper-V networking.

    Read it here:


  • Is there any performance hit when I have snapshots? For example, say I build a base server, snapshot, install software, snapshot again, promote it to a DC, and snapshot again.

    Does the VM "read" through all these snapshots, thereby impacting performance?

  • I think there's still more than meets the eye here..

    My observation -

    Create a snapshot and you see the .avhd file appear in \snapshots\guid

    But it isn't read only - this file gets bigger. What' s interesting is the behaviour when you apply the snapshot, the .avhd CHANGES FILE NAME and reverts back to the size when I took the snapshot.

    So I'm currently a little unclear about where the "third" virtual disk file is:

    1 = the original .vhd which doesn't get touched once you snap (until you 'collapse' snaps)

    2 = the read only snapshot .avhd

    3 = the one where the writes are going :)

  • I have a question too:

    what about moving a VM with its snapshots to another Hyper-V Host Server?

    Thanks for your great work Ben.

    Greets from Italy,


  • I too would be very interested in learning what it would take to move a VM to a different Host.

    Thanks for the great info!


  • I have attempted to trigger the merge process by deleting my snapshots, as indicated above.  The XML file has the global setting of <disk_merge_pending type="bool">True</disk_merge_pending>

    However, it has been several days with the machine OFF and still no merge.  

    Can I force this merge to start?  Which service or process is responsible for the merge?

  • Ken -

    Yes there is performance hit, but it is minimal.

    Simone -

    You need to export the VM and then import it on the other computer.

    Darrin -

    No, but there are bugs in the merging code that we are trying to fix.



  • I've deleted all the snapshots in Hyper-V. But in the Snapshots folder, the snapshots and the avhd files are still there and the VHD has not been update. When and how do the avhd, and other data get saved back and committed to the VHD file?

    You mentioned a bug in the merge code. If the bug gets fixed, will my problems be sorted out as well and the merge will handle the saving back into the VHD?

  • Hi Ben,

    Thanks for another informative article - I'm a little confused though and hop you can help.  If I create a snapshot then carry on working, am I using the original VHD or the AVHD?  I'm currently fighting with the AVHD merge bug and trying to rescue my VHDs to upgrade from Hyper-V beta to RC0 and wondered if it's safe to work with just the VHD (or will that take me back in time to the point when my first snapshot was taken?)

    Regards, Mark

  • I am interested in changing a VM snapshot via the WMI API.  Any idea if this is possible?  I can start/stop machines, change lots of settings, but I don't see this (in RC0).

  • I have a question about opening the .avhd file.

    When take below steps:

    1) power on a VM

    2) take a snapshot, we name it snap_01.

    A .avhd file is create for snap_01, this file's full path can be found in the settings of snap_01.

    But when I try to open this .avhd with GENERIC_READ and FILE_SHARE_READ, it report ERROR_SHARING_VIOLATION(0x20).

    However, if we poweroff the VM, this .avhd could be opened successfully.

    In my opnion, the .avhd of snap_01 should be readonly, changes to the VM will be write to the .avhd that represent the snap "NOW". I don't know why the .avhd of snap_01 can NOT be opened when the VM is running.

    Could you please point out the reason?



  • When I open the .avhd of snap_01 with FILE_SHARE_READ | FILE_SHARE_WRITE, it return success. This means this .avhd is open with write access by someone else.

    I'm a little confused why this .avhd is still be open with write access after the snapshot is taken.

    May its content be changed after served as a snapshot?

  • Carlo -

    The best thing to try here is stopping and starting the virtual machine management service.  This will "kick start" any failed merge actions.

    Mark Wilson -

    Once you create a snapshot you are now running on the AVHD.

    tim -

    No, you cannot change settings on a snapshot.

    Dengfeng -

    We lock the AVHDs of the current snapshot and its parent.  So if you want to access an AVHD "under the covers" you will need take two snapshots.



  • How about how to actually get the "Shapshot" process to work when it does not?  I have Hyper-V on my Win2008 R2 machtine, I shut the VM down, but Hyper-V does not merge.  This is obviously an issue when you need it to do the very thing you want.  I'm even surprised that there is no "Force Merge" option anywhere in the MMC.  

    - Rashad Rivera

Page 1 of 2 (19 items) 12