Snapshot Chain
Definition
A parent VMDK or VHDX plus one or more child differential disks. Each child captures changes since its parent was snapshotted. Reading a specific snapshot requires walking the chain back to the parent.
Related terms
- Files on-Demand
- Microsoft OneDrive feature that represents cloud-only files as 0-byte placeholders on the local NTFS volume, marked with a reparse tag IO_REPARSE_TAG_CLOUD. The...
- Qcow2
- QEMU Copy-On-Write version 2. The native disk format for QEMU and KVM hypervisors, with built-in snapshot, compression and encryption support. Used widely...
- Reparse Point
- An NTFS attribute that redirects file access to another handler. Cloud providers use reparse tags to insert their sync drivers between the...
- VHDX
- Microsoft's second-generation virtual hard disk format, used by Hyper-V and recent Windows containers. Supports up to 64 TB, has block-level CRC, and...
- VMDK
- VMware Virtual Machine Disk. The on-host file that holds the guest VM's disk contents, either as a monolithic file or split into...
Explained in
- Virtual Machine and Cloud-Backed Endpoint ForensicsA parent VMDK or VHDX plus one or more child differential disks. Each child captures changes since its parent was snapshotted. Reading a specific snapshot requ...