Snapshot Chain
Definition
A parent VMDK or VHDX plus one or more child differential disks. Each child captures changes since its parent was snapshotted. Reading a specific snapshot requires walking the chain back to the parent.
- Structure
- Parent disk plus one or more child differential disks
- Common formats
- VMDK, VHDX
- Child content
- Changes made since its parent was snapshotted
- Reading requirement
- Walk the chain back to the parent
Common questions
Why does snapshot order matter in a forensic examination?+
Reconstructing the disk state at a particular snapshot requires applying the differential changes in the correct parent-to-child sequence, so getting the chain order wrong produces an inaccurate view of the data.
What risk does a broken snapshot chain create for an investigation?+
A missing or corrupted link in the chain can leave some historical disk states impossible to reconstruct fully, or make recovered data appear inconsistent with what actually existed at that point.
Related terms
- Files on-Demand
- Microsoft OneDrive feature that represents cloud-only files as 0-byte placeholders on the local NTFS volume, marked with a reparse tag IO_REPARSE_TAG_CLOUD. The...
- Qcow2
- QEMU Copy-On-Write version 2. The native disk format for QEMU and KVM hypervisors, with built-in snapshot, compression and encryption support. Used widely...
- Reparse Point
- An NTFS attribute that redirects file access to another handler. Cloud providers use reparse tags to insert their sync drivers between the...
- VHDX
- Microsoft's second-generation virtual hard disk format, used by Hyper-V and recent Windows containers. Supports up to 64 TB, has block-level CRC, and...
- VMDK
- VMware Virtual Machine Disk. The on-host file that holds the guest VM's disk contents, either as a monolithic file or split into...