A lot of people have asked me what happens “under the covers” when they delete a snapshot.  Unfortunately, the answer is relatively complicated as there are multiple things that could happen.

As previously discussed – a snapshot is composed of a configuration file, saved state files and differencing disks (AVHDs).  When you delete a snapshot the snapshot configuration file and saved state files are always deleted immediately – and the snapshot entry is removed from the user interface.

What happens to the AVHD depends on the situation of the snapshot and the state of the virtual machine.  Here I have a virtual machine setup with a bunch of snapshots:

Let’s look at what would happen if I deleted various snapshots associated with this virtual machine:

1. Snapshot 4
   
   If I delete this snapshot – the AVHD will be deleted immediately.  There are no other snapshots that refer to this snapshot, and the virtual machine is not currently running off of it – so it can be quickly and easily deleted.
   
   
2. Snapshot 1, Snapshot 3, Snapshot 5
   
   All three of these snapshots have a single other snapshot dependant on them (or in the case of Snapshot 5 – the running virtual machine).  This means that if they are deleted their AVHD files will be merged into the chain.  AVHD merging can only happen when the virtual machine is not running – so the AVHD will remain while the virtual machine continues to run but will be merged as soon as the virtual machine stops.
   
   
3. Snapshot 2
   
   Snapshot 2 has two snapshots dependant on it (Snapshot 3 and Snapshot 5).  As such we will do nothing to the AVHD file when this snapshot is deleted.  We could merge the AVHD into both of the branches that depend on Snapshot 2 – but this is almost guaranteed to end up using more disk space – which could result in the whacky scenario where deleting a snapshot would fail because there was not enough space available.  Note that if Snapshot 2 were deleted, and later on both Snapshots 3 and 4 were deleted – we would detect this and merge the AVHD for Snapshot 2 away as soon as possible.

This answer has probably raised some questions in your mind – so let me take a shot at answering some of them:

• Why do you call this “deleting a snapshot” when there could still be files left around afterwards?
  
  In all three cases above the “snapshot” is deleted.  Which is to say that the point in time image of your virtual machine is gone, and you can no longer go there.  If you had an important document that only existed in a specific snapshot of a virtual machine – and you deleted that snapshot – then the document is gone.  It does not matter whether we are deleting or merging the AVHDs under the covers- the snapshot is still effectively gone.
  
  
• Why not use a different word than “delete”, like “remove”, as “delete” carries very specific connotations in my mind?
  
  This is an argument that I have often had with our text team.  The two main arguments for using “delete” are as follows: 1) From an end user impact, “delete” – with all of its connotations – is appropriate.  The fact that it does not line up completely with what is happening under the covers is a far removed secondary point. 2) Where ever possible we try to stick to known and established computing terms.  This aids in the process of localization, and is easier for users who do not have English as their native language.
  
  
• Why not say “delete snapshot” when the AVHD is going to be deleted and “merge snapshot” when the AVHD is going to be merged?
  
  Today all of this logic is part of the core platform – and the only option exposed through our WMI interfaces is to “delete” a snapshot.  If we changed this it would place a burden on anyone scripting / programming to our interfaces where they would have to determine whether it was appropriate to merge or delete the snapshot.  Also – many people would be confused by what “Merging a snapshot” actually meant.

Cheers,
Ben