Hyper-V has a feature I'm sure you may have read about or even seen in action called "snapshots". Whilst it sounds obvious what these are, its not quite as obvious as it sounds. I thought I'd take a moment to explain exactly what happens when you create a snapshot of a running virtual machine under Hyper-V.

• The virtual machine is momentarily paused
• A differencing disk is created for each virtual hard disk in the virtual machine and linked directly to it (on the fly)
• A copy of the Virtual machines configuration file is created
• The virtual machine is resumed

(The above all happens very quickly and you shouldn't notice it happen - the running machine won't miss a beat!)

Once the Virtual machine is resumed and running again the information stored in the Virtual machines memory is written down to disk. As this happens the snapshot process monitors the memory activity within the running virtual machine for any changes that may occur whilst the copy is in progress, if anything changes in the small amount of time all this takes to complete the write process is intercepted, paused, and the original memory contents are copied before the changes are allowed to proceed to disk (This can cause a running machine to hang for a second as this occurs but the machine will catch up and recover everytime).


When all of this is complete you are left with a complete virtual machine configuration file, the virtual machines saved state files and the newly created
"snapshot" or "differencing" disk/s (These are saved down to the disk as .AVHDS files) and are usually located in a sub folder of the Virtual machines
original snapshot directory (this was setup when you created the virtual machine initially). This snapshot is now treated as a roll back point for the virtual machine and when applied to the running virtual machine (usually after a fault or bad installation maybe) tells the system to start the virtual machine from the copy. Think of it as a more radical version of system restore but for whole operating systems!