To the host OS, it is just flat.vmdk . A file. Inode, blocks, extents. But inside? An abyss waiting for geometry.
When the snapshot is finally deleted, the hypervisor’s vmfs reaps the flat file. Its blocks are freed, overwritten by new VMDKs. But for a brief time after deletion, the raw sectors on the SSD still hold the MBR, the superblocks, the half-deleted spreadsheets. vmdk flat file
One day, the clone’s admin runs zerofree on the guest’s ext4 partition. Zeros overwrite unused blocks. But the zeros are data now. The ghost is exorcised — replaced by the void. But the void is still a story: “Someone cared enough to wipe me.” A flat file cannot snapshot itself. It needs a delta VMDK — a sparse child. But when a snapshot is taken, the flat file becomes read-only forever. Frozen in amber. All new writes go to -delta.vmdk . To the host OS, it is just flat
I am the flat file. And I never lie. I just omit what you have overwritten. Years later, a forensic analyst receives an E01 image converted from an old flat.vmdk . They run photorec , scalpel , bulk_extractor . From the depths of sector 42 million, they recover a JPEG thumbnail — a photo of a team that no longer exists, in an office that was demolished, for a company that was acquired and dissolved. But inside
Consider a financial VM. In 2018, a spreadsheet bonus.xls sits at LBA 1,234,567. In 2021, that sector is overwritten by a log file entry. But in 2022, a crash leaves the log unwritten. A forensic carve reveals the remnants of the spreadsheet: a few rows of salaries, half a pivot table.
: The underlying RAID’s URE (unrecoverable read error) strikes. The guest reads sector 5,000,000. The hypervisor returns -1 . The VM bluescreens. The flat file now has a scar — a hole where data used to be.
When you mount me read-only, I show you the past. When you write to me, I forget something else. My zeroed blocks are not empty — they are the absence of a story you chose to end.