The first full upgrade on a fresh Kali install is enormous - hundreds of packages, sometimes a new kernel. Usually it goes fine. When it does not, the difference between a ruined evening and a shrug is one snapshot taken before you pressed Enter. This is the cheapest insurance in any lab.
Snapshots are the single feature that makes learning security tools in a VM so forgiving. This page explains what a snapshot really is, the three moments a Kali lab should always have one, and the honest limits - because a snapshot is powerful, but it is not a backup. Kali Linux is a professional security testing system. Use it only on computers and networks you own, or where you have clear written permission to test. That one rule is what separates a security professional from a criminal.
A snapshot freezes the VM's disk and state at one moment. Work after that moment is written separately, so VMware can roll the VM back to the frozen point exactly - same files, same settings, same everything.
That includes the bad states, which is the point: an upgrade that broke the desktop, a configuration change that locked you out, a tool install that trashed dependencies. Revert, and it is as if the last hour never happened. For a learning lab, this is close to magic - and it is one menu click: VM - Snapshot - Take Snapshot.
A fresh Kali ISO is a snapshot of the project from its release day. Your first sudo apt full-upgrade -y can pull down a very large set of changes, occasionally including kernel and desktop components. The correct order is:
Two snapshots, five minutes, and no upgrade can ever cost you the whole install again.
Before experiments. New network configuration, a service you are about to expose to your lab network, an unfamiliar tool with system hooks - snapshot first. The question to ask is simply: "if this goes wrong, do I want to debug it or undo it?" For learning, undo is usually the smarter teacher.
Before target practice. If you run deliberately vulnerable training machines (the kind made for practice, on your own isolated lab network), snapshot the Kali box in a known-good state so every session starts clean and comparable.
A snapshot lives on the same host disk as the VM itself. If that disk dies, or the VM files are deleted or encrypted by ransomware on the host, the snapshots die with it. A snapshot is an undo button, not a backup. If your lab matters, copy the whole VM folder somewhere else occasionally.
Snapshots also cost disk space and, if left chained for months, slow the VM down. Keep the base snapshot and a current one; delete the ancient middle layers you no longer need. And never take a snapshot mid-installation or mid-upgrade - a frozen half-written state helps nobody.
"Snapshot 7" taken in March tells you nothing in October. A name like "2026 - clean updated base" plus one description line - what works, what is installed - turns the snapshot list into documentation. When something breaks at midnight, you will choose the right restore point in seconds instead of guessing. Small discipline, large payoff.
Every screen of the Kali Linux VMware installation, shown live step by step.
Watch Full VideoTwo working ones cover most labs: a permanent clean base and a recent good state. More than a handful of old snapshots wastes disk space and slows the VM down.
Yes - that is exactly its job. Revert to the pre-upgrade snapshot and the VM returns to its earlier state completely, including files and settings, as if the upgrade never ran.
No. Snapshots sit inside the VM's own folder on the same disk, so they protect against bad changes, not against disk failure or losing the host. A real backup is a copy of the VM folder stored somewhere else.