VM Snapshot
Definition
A point-in-time copy of a managed disk taken at the storage layer (EBS, Azure managed disk, GCP persistent disk). Crash-consistent by default; application-consistent only if the OS is quiesced.
- Layer
- Storage layer of a managed disk
- Examples
- AWS EBS snapshot, Azure managed disk snapshot, GCP persistent disk snapshot
- Default consistency
- Crash-consistent
- Application-consistent when
- The OS or application is quiesced first
Common questions
What is the practical difference between crash-consistent and application-consistent for an investigator?+
A crash-consistent snapshot looks like the disk state after a sudden power loss, so open database transactions or buffered writes may be incomplete. An application-consistent snapshot flushes in-memory data to disk first, giving a cleaner state, which matters when reconstructing database or log integrity.
Does taking a VM snapshot capture the contents of RAM?+
A disk snapshot alone does not. Capturing volatile memory requires a separate memory acquisition step, or a full VM suspend/pause that writes memory state to disk, which cloud providers support differently, so investigators confirm what a given snapshot type actually preserves.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- Control-Plane Log
- A record of management API calls against cloud resources (create, delete, modify, attach IAM role). AWS CloudTrail, Azure Activity Log, and GCP...
- Data-Plane Log
- A record of operations on the data inside a resource: S3 object reads, KMS decrypts, database queries. Off by default in most...
- Forensic Account
- A dedicated cloud account, separate from the production account, that holds shared snapshots, the forensic analysis instance, and the chain-of-custody artefacts. Isolating...
- Service Control Policy
- An AWS Organizations policy attached to an account or OU that constrains what IAM principals inside the account can do. Used in...