Files are flexible, and this is why snapshots can be made of virtual machines – pass-through disks do not support snapshots. The default location for storing a snapshot is configured in the virtual machine settings. By default, the snapshots are stored in subfolder of the virtual machine’s folder called Snapshots. You can change this setting and you can move snapshots using Live Storage Migration.
The configuration of the virtual machine is stored in an XML. The contained settings are copied into an XML file in the Snapshots folder. The running state of the virtual machine is also stored using BIN and VSV files.
Each virtual hard disk of the virtual machine is also treated by the snapshot. This is done using a special kind of differential virtual hard disk called the advanced virtual hard disk (AVHD):
A virtual machine can be sent back in time by applying the snapshot – that is, by erasing the contents of the AVHD/X files. A snapshot can be deleted by merging the AVHD/X back into their parent VHD/X files.
In one word: Yes – but all powerful tools can be dangerous if misused. You must ensure that the guest applications in the virtual machine support snapshots and you must understand that you can delete data by applying a snapshot to a virtual machine.
Like with differential virtual hard disks, a snapshot should not be a short-term solution. Once created, all writes will go into the VHD/X files. This can lead to unplanned storage consumption. The physical LUN that stores virtual machines can fill. If this happens, Hyper-V will protect virtual machines that are stored on that LUN by pausing them.
There are several deadly mistakes that one can make with snapshots:
The final issue was resolved in Windows Server 2012 Hyper-V. In versions of Hyper-V, deleting a snapshot was not enough – you also needed to shut down the virtual machine to allow Hyper-V to merge the AVHD/X files back into the parent VHD/X files. Live snapshot merging is a feature of Windows 8 Client Hyper-V and Windows Server 2012 Hyper-V. The merge may not be immediate, but it will happen within a few minutes of the snapshot being deleted, and it will happen without shutting down the virtual machine.