I am trying to find a way to read the file content just for the changed user files in a VM.
Snapshots are supposed to be incremental once they implement Copy on Write, is this accurate? However, when I mount the vmdk of a snaphot, the whole original vmdk is mounted, not just the changed files.
Is there a way to identify the OS/user changed files and somehow mount the delta disk file to read the file content?
This is not trivial.
A delta.vmdk or a sesparse.vmdk does not contain a filesystem in itself.
So no standard mount-tool will be able to work against a delta or sesparse.vmdk.
With a significant amount of work you could create a script that reads the delta / sesparse.vmdk and then shows you a list of newly added files.
But files that have been modified or expanded in size can only be detected if you read the base-disk as well.