A snapshot freezes a virtual machine in time so you can return to that exact moment after an experiment goes wrong. It is the feature that turns a VM into a true lab. This page covers how snapshots work, the habits that keep them useful, and the one misunderstanding that costs people their data.
Install a suspicious program, change a registry setting, test an update - on a real PC these are commitments. In a VM with a snapshot, they are a five-minute trial with an undo button. A snapshot records the VM's disk and state at a moment in time; everything you do afterwards is written separately, so restoring the snapshot throws the afterwards away completely. Build the habit snapshot first, experiment second and a virtual machine becomes the safest computer you own.
Clean install, Before driver test, Office installed. "Snapshot 7" tells that future person nothing.Taking a snapshot of a running VM is allowed and also saves its memory state, so it restores to a live desktop - handy, but the file is bigger and a powered-off snapshot is the cleaner habit for milestones.
To roll back, select the snapshot and click Restore. Be clear about what happens: everything done after that snapshot is erased - files created, programs installed, settings changed, all of it. That total erasure is exactly what you want after a bad experiment, and exactly what you do not want by accident.
VirtualBox asks whether to snapshot the current state before restoring. If there is anything in the current state you might want, say yes - it costs a few seconds and turns a one-way door into a revolving one. If the current state is the mess you are escaping, skip it and let it go.
Deleting a snapshot does not throw its data away - it merges the changes recorded in that snapshot into its neighbour, which can take a while on a large VM and must not be interrupted. Deleting the oldest snapshots of a long chain is the slow kind of housekeeping. Two rules keep you out of trouble: delete snapshots while the VM is powered off when you can, and never let a chain grow so old and long that tidying it becomes an afternoon's work.
This is the most expensive misunderstanding in VirtualBox. A snapshot lives in the same folder, on the same physical disk, as the VM itself. If that drive fails, or the VM folder is deleted, the snapshot dies with everything it was protecting. A backup is a copy somewhere else - an exported appliance or a copied VM folder on another drive.
Use each tool for its job: snapshots for "this experiment might go wrong in the next hour", backups for "this VM matters and I cannot lose it". The guide in this series on moving and backing up a VM covers the second job properly.
Every snapshot adds a differencing disk file, and every write afterward lands in the newest one - so a long chain quietly eats disk space and adds a small performance cost on every read. Keep chains short: a clean-install base plus one or two working snapshots is a lab. Twelve snapshots from three months ago is an archaeology project. Review the chain monthly, merge away the experiments that succeeded (their changes become permanent), and keep only the milestones you would genuinely return to.
The full tutorial walks the whole VM lifecycle - and the video shows the clean state you should capture as your first snapshot.
Watch Full VideoYes - restoring returns the whole VM, files included, to the moment the snapshot was taken. Anything created after that moment is erased. If you need anything from the current state, take a snapshot of it first when VirtualBox offers, or copy the files out before restoring.
Few. A clean-install base snapshot plus one or two recent working ones is plenty for most people. Each snapshot consumes disk space as the VM changes, and long chains make deletes slow because deletion merges data. Review the chain regularly and merge away old experiments.
No. Snapshots are stored with the VM on the same disk, so a failed or deleted drive takes them too. For real protection, copy the VM folder or export an appliance to a different drive - that is a backup; a snapshot is only a rollback point.