how to read the user/guest OS file content for changed files among 2 VM snapshots

[guicampo2]

Hi All,

I am trying to find a way to read the file content just for the changed user files in a VM.

Snapshots are supposed to be incremental once they implement Copy on Write, is this accurate? However, when I mount the vmdk of a snaphot, the whole original vmdk is mounted, not just the changed files.

Is there a way to identify the OS/user changed files and somehow mount the delta disk file to read the file content?

Thank you.

[continuum]

This is not trivial.
A delta.vmdk or a sesparse.vmdk does not contain a filesystem in itself.

So no standard mount-tool will be able to work  against a delta or sesparse.vmdk.
With a significant amount of work you could create a script that reads the delta / sesparse.vmdk and then shows you a list of newly added files.

But files that have been modified or expanded in size can only be detected if you read the base-disk as well.