VMware ESXi and vSphere Cluster Management

Virtual Machine Snapshots in Oracle VirtualBox

Learn what Oracle VirtualBox snapshots capture, how to create and view them, restore earlier VM states, delete snapshots safely, and avoid common risks.

A virtual machine (VM) is a software-defined computer that runs an operating system and applications inside VirtualBox. A snapshot is a recoverable record of that VM at a particular moment. It lets you return the VM to an earlier condition after testing software, changing settings, or performing another risky task.

Snapshots are useful rollback points, but they are not a complete backup. A snapshot normally remains part of the VM's snapshot chain and depends on the VM files and host storage remaining healthy.

What a VirtualBox Snapshot Means

When you create a snapshot, VirtualBox names a point in the VM's lifecycle. The snapshot records relevant machine settings and the state of attached virtual disks. Changes made afterward are tracked relative to that earlier disk state rather than silently changing the saved point.

The Current State entry represents the VM as it exists now. Before any snapshot exists, Current State is the only state shown. After a snapshot is created, Current State represents changes made after that snapshot, including later configuration changes, disk writes, and possibly the current power or memory condition.

Creating a snapshot is different from copying, exporting, or backing up a VM:

A snapshot is designed for quick, short-term rollback within the same VM.
A copied VM is a separate copy, although copying active or changing VM files without a suitable procedure may produce an unusable or inconsistent result.
An exported appliance is intended to package a VM for transfer or later import.
An independent backup or export can protect against loss of the host's disk or damage to the original VM files.

What a VirtualBox Snapshot Can Include

Component	What is preserved	Why it matters during restore
VM configuration	Machine settings associated with the snapshot, such as configured hardware and attached storage relationships.	The VM can return to the configuration used at that checkpoint.
Virtual disk state	The recorded contents of attached virtual disks at the snapshot point. Later writes are tracked separately through the snapshot structure.	Guest files and operating-system changes can roll back to their earlier condition.
Power state	Whether the VM was powered off, running, paused, or saved when the state was captured.	The restored VM may need to start, resume, or be shut down depending on the captured condition.
Optional memory state	RAM contents when a running VM snapshot includes memory.	A live session may resume near its captured execution point, but the snapshot is larger and may have consistency limitations.

Memory state means the contents of the VM's virtual RAM. Capturing it can preserve open applications and in-memory work. It does not make outside systems stop: network services, clocks, databases, and other machines may continue changing while the VM is stopped at that captured point.

Snapshot States and the Snapshot Tree

VirtualBox displays snapshots in a snapshot tree, the parent-child structure that shows how checkpoints relate to one another.

Initially, the VM has a Current State and no named snapshot.
Creating a snapshot establishes a named point in time, such as Clean OS Baseline.
Installing software or changing the VM creates a newer Current State relative to that snapshot.
Creating another snapshot makes the newer point a child or descendant of the earlier one.
Creating a snapshot after moving back to an earlier point can produce another branch, so the tree may no longer be a single straight line.

The tree helps identify which snapshot is selected, which snapshot is the parent of another, and where Current State is located. A restore moves the VM to a selected point. Changes made after that point may be discarded unless you deliberately preserve them by retaining the current state through the restore workflow or by creating a separate snapshot first.

Viewing Snapshots in VirtualBox Manager

Open VirtualBox Manager, the graphical application used to manage VirtualBox VMs.
Select the target VM in the machine list.
Open the Snapshots view for that selected machine.
Inspect the tree. Named snapshots normally show their names, timestamps, and descriptions; Current State shows the present working state.
Select a snapshot to inspect its details or use an available action such as take, restore, or delete.

If no snapshot has been created, Current State can still appear. That entry does not mean a saved rollback point exists; it identifies the VM's present state.

Creating a Snapshot

Choose a useful baseline

Good checkpoints are task-oriented. Examples include immediately after installing and updating a guest operating system, immediately before a driver change, or just before testing an application update. Avoid creating snapshots for every minor action; excessive checkpoints make the tree and storage harder to manage.

Create one in the graphical interface

Shut down the guest when a clean and consistent disk state is important. If the guest must remain running, close or quiesce applications that are sensitive to interruption.
Select the VM in VirtualBox Manager and open its Snapshots view.
Choose the control to take or create a snapshot.
Enter a clear name, such as Clean OS Baseline - 2026-08-19.
Add a description explaining the guest condition and intended rollback purpose, for example, OS updated; before installing experimental package.
Choose whether to include the running memory state when VirtualBox offers that option, then confirm the operation.

A snapshot taken while the VM is powered off records a simpler, usually more predictable baseline. A snapshot of a running VM can include RAM and preserve a live session, but it requires additional storage and may restore applications, locks, timers, and network connections in surprising conditions.

Use VBoxManage

VBoxManage is VirtualBox's command-line management utility. Use the exact registered VM name or its UUID in place of VM Name. Confirm names carefully before restore or deletion.

VBoxManage snapshot "VM Name" take "Clean Baseline" --description "State before testing"
VBoxManage snapshot "VM Name" list
VBoxManage snapshot "VM Name" restore "Clean Baseline"
VBoxManage snapshot "VM Name" delete "Clean Baseline"

take creates a named snapshot and description.
list displays snapshots associated with the VM.
restore returns the VM to the selected snapshot.
delete removes the selected snapshot and may start disk consolidation.

Command names and options can vary slightly by VirtualBox version. Check the installed version's local command help when scripting.

Restoring a Snapshot

Select the VM and open the Snapshots view.
Select the intended snapshot in the tree.
Choose Restore and read the confirmation carefully.
If the interface offers an option to create a snapshot of the current state, use it when you may need to return to the newer state. Otherwise, the post-snapshot changes may be removed from the active disk and configuration path.
Start the VM and verify the guest operating system, files, applications, settings, and required services.

Restoring is a rollback operation. Files created after the selected checkpoint, application updates, guest configuration edits, and other newer disk changes may no longer be present. Save important newer data elsewhere before restoring.

Snapshot Actions and Their Effects

Action	Effect on the VM	Effect on later changes	Storage consideration
Create snapshot	Names and records a recovery point.	Future changes accumulate as Current State relative to that point.	Later disk writes can cause snapshot-related storage to grow; memory capture adds more data.
Restore snapshot	Returns settings and disks to the selected checkpoint.	Newer changes may be discarded unless the current state is preserved.	VirtualBox may need to adjust the disk chain.
Delete snapshot	Removes that rollback point from the tree.	It does not intentionally roll the guest back to that point.	Changed disk data may be merged and require time and free space.
Keep Current State	Preserves the newer state through an appropriate snapshot or restore choice when offered.	You can retain a path back to newer work while restoring another checkpoint.	Preserving another state consumes additional storage.

Deleting Snapshots Safely

Deleting a snapshot does not simply remove a small label. VirtualBox may have to perform a snapshot merge, consolidating changed virtual-disk data into another disk in the chain. The operation can take considerable time, especially for large VMs, snapshots with many descendants, or guests that have performed many disk writes.

Do not delete a snapshot until you are certain it is no longer needed as a rollback point.
Check available host storage before deletion. Consolidation may temporarily require substantial free space.
Deleting an older snapshot can affect the disk chain and may require more work than deleting the latest snapshot.
Deleting the latest snapshot can still require a merge; it is not guaranteed to be instantaneous.
Allow the operation to finish. Do not force-close VirtualBox, power off the host, or manually remove disk files during a merge.

Practical Snapshot Workflows

Clean operating-system baseline

Install and update the guest operating system.
Power off the guest, or otherwise place it in a consistent condition.
Create Clean OS Baseline with a description.
Install experimental software and perform the lab work.
Restore the baseline when the experiment finishes or fails, then verify that the guest is clean.

This creates a repeatable lab environment without reinstalling the guest operating system each time.

Risky application update

Create a snapshot immediately before the update.
Perform the update and test the application.
Keep the snapshot during the rollback period.
Restore it if the update causes problems, or delete it after the update is accepted and independently protected.

This is a short-term rollback strategy, not a replacement for preserving application data.

Running lab environment

Leave the VM running with the lab application open.
Create a snapshot that includes memory state.
Later restore it and observe that the guest may resume near its earlier in-memory condition.

Memory capture can preserve a live session, but it increases storage requirements and is not ideal for every workload. Restart services if restored network connections or external dependencies are stale.

Snapshot Versus Backup

Characteristic	Snapshot	Independent backup or export
Primary use	Fast rollback during testing or configuration work.	Long-term protection, migration, or disaster recovery.
Protection from host disk failure	Usually none when stored on the same host disk as the VM.	Can protect against host failure when stored on separate, reliable storage.
Storage location	Part of the VM's local snapshot and virtual-disk structure.	A separate backup destination or exported appliance.
Rollback speed	Usually convenient within the same VirtualBox installation.	May require copying, importing, or restoring files first.
Long-term retention	Poor choice because chains grow and remain dependent on the VM.	Better choice when retention and disaster recovery are required.

Use independent backups or exports for important data and long-term protection. A snapshot cannot protect you if the host drive fails, the VM directory is damaged, or the snapshot chain becomes unusable.

Planning and Best Practices

Create snapshots before updates, driver changes, configuration experiments, malware analysis in an isolated lab, and course exercises.
Use descriptive names containing the task and, when useful, a date.
Write descriptions that state what was installed, changed, or verified.
Keep snapshot chains short and remove obsolete checkpoints during planned maintenance.
Monitor host storage. Snapshot-related disk data grows as the guest changes, and a full host drive can prevent creation, merging, or normal VM operation.
Shut down or quiesce databases and transaction-heavy workloads when application consistency matters.
Keep external backups or exports for disaster recovery and valuable guest data.
Remember that a restored VM can have stale clocks, expired credentials, broken sessions, or outdated network connections when it interacts with changing external systems.

Limitations and Risks

Snapshots are not backups and normally do not protect against host storage failure.
Long-lived or numerous snapshots can consume substantial storage and may reduce VM performance.
Restoring can remove newer guest files, application state, and configuration changes.
Workloads depending on network services, external databases, transactions, or changing outside systems may not behave correctly after a rollback.
Insufficient host free space can prevent snapshot creation, disk merging, or ordinary VM operation.
A live-memory snapshot can preserve a process state that is no longer valid when external resources have moved on.

Troubleshooting

No snapshots appear

Select the intended VM, open its Snapshots view rather than the general machine-details view, and check whether only Current State is present. Current State is expected when no named snapshot has been created.

Snapshot creation fails because of insufficient storage

Free space on the host or move the VM to storage with adequate capacity. Remove obsolete snapshots only after confirming that they are no longer needed. If a memory capture is unnecessary, create the snapshot without including memory state.

Recent files are missing after restore

The files were probably created after the restored checkpoint. Treat the operation as an intentional rollback. Recover newer data from a separate backup or from a preserved current-state snapshot if one was created before restoration.

Deleting a snapshot takes a long time

VirtualBox may be merging disk changes. Large VMs, extensive writes, and many descendants increase the work. Ensure sufficient free space, schedule cleanup during a maintenance window, and allow the process to complete without force-closing VirtualBox or powering off the host.

A running VM resumes with an unexpected application or network condition

Restored memory can contain active processes and connections, while external services continued changing after the snapshot. Use a powered-off snapshot for a more predictable baseline when appropriate, restart affected services, and avoid relying on live-memory snapshots for externally coordinated or transaction-sensitive workloads.

Exam-Relevant Notes

Snapshot: a recoverable VM state at a particular moment, including VM state and disk-related state.
Current State: the present state of the VM relative to its snapshots, including subsequent changes.
Restore: returns settings and virtual disks to a selected checkpoint and can remove newer changes.
Delete: removes a checkpoint from the tree but may trigger a time-consuming disk merge.
Memory state: optional RAM contents that can preserve a live session but increase size and consistency risks.
Backup: an independent protection method that should be used for disaster recovery and long-term retention.

For related learning, see Virtual Machine Snapshots.