Powered-off restore: text walkthrough
Interface reference: Oracle VirtualBox 7.1 guide.
This is a conceptual sequence, not a record of clicks or screenshots.

Starting state: a disposable guest, one normal disk, no host sharing.
Guest Documents/yanosec-snapshot-lab exists and is empty.
1. Shut down Ubuntu normally. Manager state: Powered Off.
2. Select that VM. Open Snapshots; take snapshot lab-empty.
3. Start the guest. Create after-baseline inside the lab folder.
4. Shut down again. Select lab-empty in Snapshots and choose Restore.
5. Start the guest. Inspect the same Documents/yanosec-snapshot-lab.
Predicted contents: the original empty lab folder remains;
the later after-baseline subfolder is absent.

Paper activity: draw before-change, after-change and after-restore columns.
Fill in folder contents and explain each transition.
Add a host Downloads row, which is outside this operation.
Label live installation and restoration deferred.

Restore replaces the included state. Delete snapshot is a different action.
Never manually delete the files on which a VM or snapshot depends.