[lug] Windows Media Player and Virtualization

[David L. Willson]

Nice examples deleted for brevity ...

> nice example[s]
> 
> to clarify further:
> 
> 1) the snapshots are deltas right?  which means that they are based on
> and
> require a parent that is more "full" in some way to complete a revert
> operation to the original working data set?
> 
> 2) it sounds like the snapshot is really more of a guest
> configuration
> snap.  so do you have to a) revert to a given snap *first* to get
> some
> underlying filesystem to look / be the way you want and *then*
> start/boot
> a single guest that somehow [re]uses the reverting underlying
> filesystem..
> or b) does each snap represent a separate guest configuration that
> you
> boot independently of the others?
> 
> hope those question makes sense

1. Yes, all snapshots are "of a particular VM" and as such have no meaning outside the context of that VM.

2. I have to answer for my chosen platform, VMware Workstation, because the answer differs from platform to platform, and sometimes even config to config.

In VMware Workstation, a VM is in "the current state". There is only one state that a VM may be in. If you want an independently runnable VM that only uses disk space where its blocks differ from it's parent, you would create a "linked clone" of the parent VM, not a snapshot.

Also in VMware Workstation, a snapshot gets the disk, memory, and execution state of the VM at the point-in-time of the snapshot. When you revert, the machine goes back to exactly what it was doing at the time you took the snapshot.

This type of snapshot is great for forensic analysis with low return-to-service time. If a VM gets hacked/infected/crashed, you snapshot it, effect a repair or revert to a pre-break snapshot so you can return the machine to service quickly. Now, you have a snapshot of the machine at the point-in-time nearest to when you noticed it broken, so you can go back and study it at that exact time, as many times as you need to, to discover all you can about what happened.  But what about the "only one state" rule? Well, remember, you can create clones, linked or full, so after you've repaired or reverted to the last-known-good, you create a clone, the clone resumes the work, while you work on the infected/hacked/borken original.