Snapshots, and how to undo a bad experiment

02Record what the baseline contains

Use a normal virtual disk with host sharing off, as in the installation lesson. Shut down Ubuntu before taking this activity's snapshot. A powered-off snapshot has no running editor memory to record. In the VM manager, Saved means suspended; it is not Powered Off. Resume a saved guest and shut it down normally if needed.

Write what should exist at the baseline and what should not. The empty lab folder will already exist; the later subfolder will not. This lets you distinguish a successful restore from opening a different folder.

If this guest contains work you need, stop and preserve it independently or use the text route. A snapshot restore can replace later changes throughout the included guest disk. Watching one harmless folder does not limit the operation to that folder.

03Try one harmless rollback

Use the following only in the disposable Ubuntu guest. The expected contents are predictions; record your own observations if you perform the activity.

Snapshot activity record
Expected states below are predictions, not recorded observations.
Use only a disposable guest with no important work and a normal disk.

Create the empty guest folder Documents/yanosec-snapshot-lab.
Shut down normally; take the powered-off snapshot lab-empty.
Start the guest; create after-baseline inside the lab folder.
Shut down normally; restore lab-empty; start and inspect the same folder.
Record actual contents before the change, after it and after restore.
Expected after restore: lab folder present; after-baseline absent.
Restore can discard other later guest changes too. Stop if work matters.

Separate question timeline:
S0: snapshot taken; guest note.txt does not exist.
Create guest note.txt.
S1: snapshot taken; guest note.txt exists.
Assume the snapshots include the normal guest disk.
Which snapshot records the state without note.txt?
Answer format: S0 or S1.

1. Start Ubuntu. Open Files, then Home > Documents. Use New Folder from the menu or Ctrl+Shift+N to create yanosec-snapshot-lab. If that name already exists, do not overwrite or remove it; use the text route or a new disposable guest. Open the new folder and record that it is empty.
2. Shut down Ubuntu normally and confirm Powered Off in the manager. Select this VM, open Snapshots and choose Take. Name the snapshot lab-empty and describe the empty lab folder. Confirm the snapshot appears before making the next change.
3. Start the guest. Open the same Documents/yanosec-snapshot-lab folder and create a subfolder named after-baseline. Record its presence. This is the only new folder change; no terminal command is needed.
4. Shut down again and confirm Powered Off. Select lab-empty in Snapshots and choose Restore. Read the dialog before confirming. If current work might matter, cancel and preserve it first. If offered a snapshot of the current state, record whether you keep it; that saved later state is different from lab-empty.
5. Start the guest and inspect the same lab folder. Expected: yanosec-snapshot-lab remains and after-baseline is absent. If your result differs, record the selected snapshot and exact folder before trying another action. Do not repeatedly restore to force a result.
6. Shut down normally and keep the baseline for later practice. Do not manually remove virtual disk or snapshot files. Delete snapshot is a different operation from Restore; the activity needs no broad cleanup.

04Complete the no-install restore walkthrough

Read the walkthrough below. Draw three columns: before the change, after the change and after restoring lab-empty. Record whether the lab folder and after-baseline exist in each column. Add a row for a host file saved after the snapshot and explain whether the restore includes it.

Compare your prediction: the lab folder exists in all three states; after-baseline exists only after the change; the host file stays outside this guest restore. Explain which recorded state produces that result. Label installation and live restore deferred.

Powered-off restore: text walkthrough
Interface reference: Oracle VirtualBox 7.1 guide.
This is a conceptual sequence, not a record of clicks or screenshots.

Starting state: a disposable guest, one normal disk, no host sharing.
Guest Documents/yanosec-snapshot-lab exists and is empty.
1. Shut down Ubuntu normally. Manager state: Powered Off.
2. Select that VM. Open Snapshots; take snapshot lab-empty.
3. Start the guest. Create after-baseline inside the lab folder.
4. Shut down again. Select lab-empty in Snapshots and choose Restore.
5. Start the guest. Inspect the same Documents/yanosec-snapshot-lab.
Predicted contents: the original empty lab folder remains;
the later after-baseline subfolder is absent.

Paper activity: draw before-change, after-change and after-restore columns.
Fill in folder contents and explain each transition.
Add a host Downloads row, which is outside this operation.
Label live installation and restoration deferred.

Restore replaces the included state. Delete snapshot is a different action.
Never manually delete the files on which a VM or snapshot depends.

05Optional challenge

Suppose the host drive holding the guest and all snapshots fails. Explain why lab-empty alone cannot establish recovery. Describe where an independent backup would need to survive. Do not simulate failure or delete a VM.

06Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

All five snapshots include the same normal guest disk.
Each snapshot was taken after a normal shutdown; no running memory is included.
08:00 — Take H1. Guest Documents/review does not exist.
08:10 — Create Documents/review and its note.txt containing outline. Take H2.
08:20 — Change note.txt to checked and create review/draft. Take H3.
08:30 — Remove only review/draft. Take H4.
08:40 — Change note.txt to final. Take H5.
The folder and note remain unless an event explicitly changes them.
These are supplied snapshot records, not actions you need to perform.

Powered-off snapshot P7 includes the normal guest disk.
At P7: guest Documents/answer.txt contains amber; guest Documents/scratch is absent.
At P7: host Shared/route.txt contains north.
Later: change the guest answer.txt to violet and create guest Documents/scratch.
Later: change host Shared/route.txt to south.
The guest can view Shared/route.txt through a shared folder.
That file stays on the host and is explicitly excluded from P7.
Now consider restoring P7 without any other file changes.
No restore or resulting folder inspection has been recorded.

Permission: this disposable guest is owned and allowed for the folder activity.
Storage: one normal guest disk; no host sharing; no important work is present.
Guest path: Documents/seed. The folder exists, but its contents were not recorded.
Manager observation: Powered Off after normal shutdown.
Planned snapshot label: before-test. The snapshot has not yet been taken.
Later planned change: create Documents/seed/tag.
The learner wants the baseline note to identify what a later restore should return.
Use this supplied record only; do not create or restore a real guest.

07Write a usable baseline note

Optional self-check: draft a short baseline note for card C. Include the exact guest path, contents you would need to inspect, the snapshot boundary, the normal shutdown and snapshot steps, and what you would inspect at the same path after restoring. Leave unobserved facts labelled unknown or predicted.

Check your note: establish whether the original folder and tag exist before the change; record the chosen snapshot with those contents; separate later guest changes from excluded host files; and distinguish an expected result from a recorded inspection. A restore can discard other later changes on the included disk. If work matters, preserve it independently or use the text route.