I thought that VDI is virtual disk image, and then I learned that it is also used for snapshots. So I opened the snapshots folder and found a bunch of VDIs. So far so good.

Then I read somewhere that SAV is used for the current state. Is this true? And if it is indeed, then we should only have one SAV file (since there will only be one current state for a virtual machine. But when I looked in my snapshots folder I found 2 SAV (and 2 VDI) files. Is that normal or is my machine corrupt?

So what is really the difference between SAV and VDI? Is a snapshot represented by one of each type?

If it matters, I'm using version 4.3.20.

1 Answer 1


You are correct in thinking that a .vdi file is a virtual disk image file, and that they are used by snapshots.

When a snapshot is created, a new .vdi file is created, in which the difference from the snapshot is stored. This is called "differencing storage".

Technically, a snapshot records an entire VM state, which [includes] all attached drives, however most people do also use the word as a synonym for "delta image", "difference image" or "child image" when discussing the role of a single VDI in a snapshot chain, other than the base VDI. Source

After a snapshot has been taken, VirtualBox creates differencing hard disk for each normal hard disk associated with the machine so that when a snapshot is restored, the contents of the virtual machine's virtual hard disks can be quickly reset by simply dropping the pre-existing differencing files. Source

You can imagine how this might be useful when you need to create multiple "branches" from one snapshot – each snapshot's VDI will contain only the differences added by that snapshot, not anything which exists in the base VDI. For example, consider a base disk (snapshot) with 50 GB of files and multiple child snapshots, each adding 10 GB of unique data. Each child VDI will only be as big as is necessary to store their 10 GB of data, rather than including the 50 GB from the base disk.

If you open the Virtual Media Manager (FileVirtual Media Manager on Windows), you can view a tree view of your virtual hard drives in the "Hard drives" tab. Here you can see the disks and their children. Clicking on a disk will display its information.

For example, I have a disk whose information displays:

Type: Normal
Location: C:\VirtualBox VMs\Foo\Foo.vdi
Storage details: Dynamically allocated storage
Attached to: Foo (Bar)

Its furthest descendant's information is:

Type: Differencing
Location: C:\VirtualBox VMs\Foo\Snapshots\{bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb}.vdi
Storage details: Dynamically allocated differencing storage
Attached to: Foo

In this example, "Foo" is the name of the VM, and "Bar" is the name of the first snapshot. "{bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb}" is the UUID of the last disk.

The VM's .vbox file contains an XML document describing the VM, including its snapshots. The VirtualBox node contains a Machine child node, which can contain Snapshot nodes. The stateFile attribute on this node specifies the .sav file associated with this snapshot, if any.

The .sav file is essentially a memory dump, though other processor information (such as registers) is probably stored too. Source
Strangely, he also says that .sav files have nothing to do with snapshots, which is incorrect.

A .sav file contains always the complete state of the guest at a certain point in time. It does not contain any information stored on external devices like virtual disks. When a snapshot is created, a .sav file is created containing the VM state which is required to restore the guest state for that time and a new differential disk image is created for each virtual disk (which is not attached in some special mode to prevent that). From now on, guest disk write requests go to the differential image. When you restore a snapshot, the differential image is removed so all changes to the disk after the snapshot was created are lost. Source

To directly answer your questions:

[...] SAV is used for the current state. Is this true?

When the machine's state is saved, the current state at that time is saved in a .sav file.

[...] we should only have one SAV file (since there will only be one current state for a virtual machine

Sure, there is only one current state, but the .sav files created by a snapshot contain previous states.

[...] I found 2 SAV (and 2 VDI) files. Is that normal [...] ?

Is a snapshot represented by one of each type?

That's normal. I'm assuming that it's possible to have multiple snapshots without .sav files if the snapshots were taken while the VM was not running, as there is no execution (volatile) state to be saved. If your machine is running when you take a snapshot, a .sav file is created.

So what is really the difference between SAV and VDI?

A .vdi file is a virtual disk, containing persistent storage. A .sav file contains a dump of volatile state information, which allows you to resume the state of a machine. Together they facilitate the complete restoration of a VM state which was created through a snapshot.

Both can be used independently of one another. .sav files are also used when you close a VM and save its state. .vdi files can also be used as persistent storage outside of the scope of snapshotting.

  • I'm sorry if this contained too much extra information – although much of it may not have been necessary to answer your question, I thought it might also be of some use to Googlers.
    – Spooky
    May 30, 2015 at 15:34
  • 1
    Definitely one of the longer answers I've received, but I think I got the gist of it: VDI is the persistent storage (virtual machine's hard drive) whereas SAV contains volatile state (virtual machine's RAM).
    – user453441
    Aug 26, 2015 at 2:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .