Step 17. Installing Ubuntu and Snapshots — Moving Into the Lab and Setting Save Points

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time: 3–4 hours (including download time)

Prerequisites: Step 16 complete (VirtualBox installed). Internet connection required (ISO download, about 5 GB).

What you need: A Windows PC with VirtualBox installed, an internet connection, and at least 30 GB of free disk space.
Caution: Today’s exercise is 100% safe. Everything happens inside the virtual machine, and even if you see a scary message like "erase disk," the only thing being erased is the virtual disk you just created.
Tip: The installation file (ISO) is about 5 GB, so the download can take 30 minutes or more. Start the download first, and read the concepts in Section 2 while you wait.

In an RPG, you save before a boss fight. If you lose, you return to the save point and try again. The snapshot you’ll learn today is the save point of a virtual machine. And the operating system moving into that lab is Ubuntu — the most widely used, most thoroughly documented Linux distribution, and the de facto standard for security practice. Today you’ll build the lab, break it, and roll it back — experiencing the whole cycle firsthand.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain what an ISO file and LTS are
Create a new virtual machine in VirtualBox and allocate resources according to guidelines
Install Ubuntu on a virtual machine and complete the first update
Explain how snapshots work (recording only the changes), and take and restore them
Explain the difference between snapshots and backups, and establish rules for "when to take one"

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/Environment	VirtualBox Manager (GUI) + Ubuntu installer + first encounter with the Linux terminal
Today’s commands	`sudo apt update && sudo apt upgrade` (first update after installation)
Concepts needed	ISO files, LTS, virtual disks (.vdi), snapshots and restore, snapshots vs. backups

2-1. ISO — A CD Burned Into a File

In the old days, you bought an operating system on a CD or DVD and installed from it. An ISO file is that installation disc turned into a single file. It has a name like ubuntu-24.04-desktop-amd64.iso and is several gigabytes in size.

To a virtual machine, this file becomes a virtual CD. When you "insert" the ISO in VirtualBox settings, the VM thinks a real CD has been loaded and reads it at boot. No physical CD or CD drive is needed.

2-2. Ubuntu and Linux — Why This One

Linux is a family of operating systems distinct from Windows, and most of the world’s servers run on it. The reasons Linux is essential for learning security are clear:

Most servers on the internet run Linux → most attack targets run Linux
Most hacking and security tools are built for Linux
Its transparent structure makes it easy to see "what the computer is actually doing"

And Ubuntu is the most beginner-friendly of the many kinds of Linux (called distributions). You can think of a distribution as "the Linux kernel plus basic programs plus management tools, packaged together" — the kernel is the same, but the packaging differs, which is how you get Ubuntu, Debian, Fedora, and so on. Kali Linux, which is famous for security practice, is also one of these distributions.

LTS stands for Long Term Support — "a stable release maintained for a long time." It’s perfect for us, since we care more about stability than the latest features. Ubuntu releases an LTS every two years and provides security updates for five years.

2-3. Virtual Disks — One File Is One Hard Drive

The biggest artifact created during installation is the virtual disk. Knowing what it really is makes VMs much easier to handle: from the host’s perspective, it’s just one big file (a .vdi file inside the VirtualBox VMs folder); from the guest’s perspective, it’s an entire hard drive.

This "file = disk" correspondence gives you practical knowledge:

To back up a VM, copy this file (or the whole VM folder)
To delete a VM, delete this file — an entire computer vanishes like a file
The disk capacity (25 GB) doesn’t get used up front; by default it grows as you use it (dynamic allocation). Even if you set 25 GB, the actual file is only a few GB at first

2-4. How Snapshots Work — Recording Only the Changes

How can a snapshot restore in just a few seconds? It doesn’t copy everything every time. From the moment you take a snapshot, only the changes made afterward are recorded separately. Restoring means discarding those changes — returning the disk to the moment the snapshot was taken.

It’s like making a backup copy of a manuscript and then editing freely. If you don’t like the result, you throw away the edits and go back to the backup. That’s why a snapshot is small right after you take it, and grows as more changes accumulate.

One thing to watch out for: a snapshot is not a backup. If the virtual disk file on the host is lost, the snapshots go with it. Snapshots are perfect as an "undo button for experiments," but never as insurance for precious data — keep that distinction in mind.

3. Follow Along

3-1. Downloading the Ubuntu ISO

In your browser, go to ubuntu.com (verify it’s the official site — the habit from Step 16!)
Choose Ubuntu Desktop from the Download menu
Download the latest LTS version

While you wait: the download takes a while, so use the time to reread Section 2 or open VirtualBox and look around the interface. It helps to find the "New" button you’ll use in the next step.

3-2. Creating a New Virtual Machine

Once the download is done (or while you wait — you can create it in advance), in VirtualBox:

Click New
Name: Ubuntu-Lab (typing the name automatically sets the type to Linux/Ubuntu)
Memory: 2048 MB or more (within the "no more than half the host" rule from Step 16. For a 16 GB host, 4096 MB is recommended)
CPUs: 2 (if possible)
Virtual hard disk: Create now → 25 GB or more

What each item means: these numbers are the "virtual parts" from the blueprint you drew in Step 16. You’re doing the same thing as choosing specs when buying a real computer — just with a few clicks.

3-3. Insert the ISO and Boot — Installation Begins

Select the VM you created → Start
When "Select start-up disk" appears on first boot, choose the ISO file you just downloaded
The VM window opens and the Ubuntu installer appears

Tips for the installation (just follow the on-screen prompts):

Language: Korean is available (English works fine too, of course)
Installation type: choose Erase disk and install Ubuntu — don’t be scared. The only thing being erased is the virtual disk; not a single file on the host is touched. This is your first hands-on experience of isolation
Username/password: be sure to remember them! Linux will keep asking for this password whenever you do administrative work

What the installer choices mean:

"Install to disk" vs. "Try" (live session): booting from the ISO lets you run Ubuntu entirely from RAM without installing. This "live environment" is later used for computer recovery and as a forensics tool
Keyboard layout: Korean 101-key is the default. Choosing the wrong one causes the classic accident of a garbled password entry
Username: this name becomes /home/username. You’ll see this address every day starting in Step 18, so take note
Password: if you forget it, your lab won’t open — write it down somewhere. But keep that note somewhere safe, not next to the computer

3-4. First Boot and First Update

When installation finishes and the machine reboots (the ISO is ejected — if not, remove it from the Devices menu), a full Linux computer with a desktop appears. Now do two things.

First, update. Open a terminal from the menu at the bottom left (or press Ctrl + Alt + T):

sudo apt update && sudo apt upgrade

When it asks for a password, type the one you set during installation. It’s normal for nothing to appear on screen as you type — not even asterisks. That’s Linux’s traditional security design (more on this in Wall 4 of Section 6).

How to read the command: sudo means "as administrator," apt is Ubuntu’s program manager, update refreshes the list, and upgrade performs the actual updates. && is a connector meaning "if the first succeeds, run the next." You’ll formally learn the world of commands starting in Step 18 — for now, commemorate this as "the first Linux command you ever typed."

Second, look around. Click through the file explorer, settings, and so on. Observing what’s similar to Windows and what isn’t is part of learning. If the screen feels small, installing an extension called Guest Additions fixes it — run "Devices → Insert Guest Additions CD image" from the VirtualBox menu and follow the prompts (not required right now).

3-5. Taking a Snapshot — Saving a Save Point

Right now, with a clean installation complete, is the perfect time for your first save:

With the VM running (or off — either works), go to the VirtualBox Manager window
Select the VM → the Snapshots tab on the right
Click Take
Name: Clean install state / Description: Right after Ubuntu install + updates

Why take it now: because this point is "a clean state with no experiments done yet." Whatever experiments you run from here on, returning to this point gives you a brand-new machine.

3-6. The Grand Experiment — Break It and Roll It Back

Today’s highlight. Let’s break things on purpose:

Inside the VM, create any file on the desktop or in the home folder (something like important.txt)
Delete that file. Empty the trash too
Now restore: in the VirtualBox Snapshots tab, select Clean install state → Restore
Restart the VM. What happens?

Observation point: what happened to the file? — Since it was created after the snapshot, it’s gone. The entire VM went back to "the moment the picture was taken." Not just the deletion — every change made in between is undone.

Make a prediction: if you take a snapshot → install software → restore, what happens to the installed program? (Answer: it disappears. A snapshot restore rolls back not just files but the entire system state — installations, settings changes, even the desktop wallpaper. This is the principle that gives you "freedom to experiment.")

Why this matters for security: later in this book, you’ll build vulnerable web servers, run exploits, and break systems. Each time, the question must be not "what if it breaks?" but "I’ll just roll it back." Today’s three-minute experiment is physical proof of that courage.

4. Missions & Exercises

Mission — Making Snapshot Management a Habit

The real skill with snapshots isn’t taking them but managing them:

Take a second snapshot right now (name: After first experiment — the state after completing the restore experiment)
Look at the snapshot list — After first experiment should hang below Clean install state like a tree branch. Each point in time is a fork
In a notepad, write three rules for "when to take a snapshot." Example: ① before a big installation, ② before a risky experiment, ③ when something works well
Considering your upcoming practice plan, write a predicted list of additional snapshots you’ll take

How to verify yourself: your three rules are complete if they answer "so when do I take one?" Losing hours of work because you didn’t take a snapshot is the classic lab accident. Rules prevent that accident.

Exercises

Question 1. Explain what an ISO file is and what role it plays in a virtual machine.

Question 2. Explain the difference between a snapshot and a backup, using the scenario "the host’s virtual disk file is lost."

Question 3. What problems arise if you take too many snapshots? Give two reasons based on the principle in Section 2-4.

Question 4. Explain why a malware analyst takes a snapshot right before running malicious code, connecting it to today’s restore experiment.

5. Model Answers & Completion Criteria

Mission Model Answer

What the snapshot list looks like (example):

Clean install state  ← right after Ubuntu install + updates
 └─ After first experiment  ← current state after the restore experiment

Example timing rules:

1. Always take one before a big installation or configuration change
2. Always take one before a risky experiment (deletion, permission changes)
3. Take one when something works well (environment setup complete, etc.)

How to verify: ① Does the snapshot list show two entries in a tree shape? ② Do all three rules answer "when"? ③ Does the predicted list reflect upcoming chapters (Linux practice, server installation, etc.)? It’s the same mindset as malware analysts repeating "snapshot right before execution → analyze → restore → rerun with different conditions" — the ability to experiment infinitely from the same initial state is exactly why virtualization is the standard environment for security research.

Exercise Answers

Answer 1. An ISO is an installation disc (CD/DVD) turned entirely into a single file. When you insert the ISO in VirtualBox settings, the VM thinks a real CD has been loaded and reads it at boot, so you can install an operating system without a physical CD — it’s a virtual CD.

Answer 2. A snapshot is a "record of changes" attached to the virtual disk file, so if the host’s virtual disk file is lost, the snapshots disappear with it. A backup (such as copying the whole VM folder), on the other hand, is a separate copy that survives even if the original is lost. That’s why snapshots are used only as an "undo for experiments," never as insurance for precious data.

Answer 3. First, the changes accumulate, consuming more and more disk space. Second, rolling back to an old snapshot also rolls back the security updates made in between. The answer is "take snapshots only at the points you need, and clean up periodically."

Answer 4. So that after analyzing how the system was contaminated by the execution, they can restore and rerun under different conditions. By the same principle as today’s experiment — "we deleted a file, restored, and it was as if nothing happened" — an analyst can return a contaminated system to a clean state in seconds and repeat the same experiment infinitely. (In this book, handling malware is concept- and analysis-focused; we do not cover creating or distributing it.)

Completion Checklist

[ ] I can explain what an ISO file is
[ ] I know what LTS means and why I chose it
[ ] I installed Ubuntu in VirtualBox
[ ] I know the guidelines for allocating VM resources (memory/disk)
[ ] I can take a snapshot
[ ] I broke a file myself and restored it with a snapshot
[ ] I can explain the difference between snapshots and backups
[ ] Mission: I wrote three snapshot timing rules

6. Common Pitfalls & Fixes

Wall 1. The download is too slow

Symptom: the ISO download is estimated at several hours.
Cause: the official server is far away or it’s a busy time of day.
Fix: use a mirror from the ubuntu.com download page (a Korean mirror server), or let it download overnight. Apart from the file being large, nothing is broken.

Wall 2. The VM is very slow

Symptom: both installation and usage stutter.
Possible causes: ① memory/CPU allocation is too small ② the host doesn’t have enough headroom ③ if virtualization (VT-x/AMD-V) is disabled, it becomes extremely slow.
Fix: shut down the VM and raise memory to 4096 MB and CPUs to 2 in settings (within host headroom). If it’s still slow, it’s time to suspect Section 3-4 of Step 16 (VT-x).

Wall 3. "Erase disk" on the installer screen is scary

Symptom: you can’t bring yourself to click "Erase disk and install Ubuntu."
Cause: the wording sounds frightening.
Fix: this screen is inside the virtual machine. The only thing being erased is the 25 GB virtual disk file we just made. Your photos, documents, and games on the host are completely unaffected — this is the substance of the isolation you learned in Step 16. Click with confidence.

Wall 4. I typed my password but nothing appears on screen

Symptom: when entering a password in the terminal, the cursor doesn’t move.
Cause: it’s not a malfunction — it’s Linux’s traditional security design. Showing nothing at all when you type a password (not even asterisks) is normal — it’s so someone watching over your shoulder can’t even learn the length.
Fix: it’s being entered even though you can’t see it. Type and press Enter. This is your first culture shock of Linux, one you’ll soon get used to.

Wall 5. Things seem weird after a snapshot restore

Symptom: you restored, but something feels off or windows don’t fit.
Cause: the memory state at the restore point may have come back too. It’s mostly temporary.
Fix: shut the VM down completely and start it again. If it’s still odd, check in the snapshot list that you restored to the intended point — restoring is just one click away, so there’s nothing to fear.

Wall 6. Commands don’t work because of Korean/English input switching in the terminal

Symptom: you typed a command but Korean characters got mixed in, or the input-source key behaves oddly.
Cause: the input methods inside and outside the VM window operate separately, so the Korean/English state of the host (Windows) and the guest (Ubuntu) often get out of sync.
Fix: before typing a command, check that the prompt shows only English letters. Linux commands are all in English, so it’s a good habit to keep the terminal in English input mode by default.

7. Summary

Today’s Concepts

Concept	One-line description
ISO	An installation disc turned into a single file — a VM’s virtual CD
LTS	A long-supported stable release — ideal for practice and servers
Virtual disk	One big file to the host, an entire hard drive to the guest
Snapshot	A save point capturing the entire VM state
Restore	Discarding the changes since the snapshot and returning to that moment

Today’s Commands

Command	What it does
`sudo`	Run as administrator (asks for a password)
`apt update`	Refresh the program list
`apt upgrade`	Update installed programs
`&&`	Run the next command if the previous one succeeded

More Important Than Commands: The Instinct

As of today, you have a reversible laboratory. "An environment you’re allowed to break + the ability to come back anytime" — the two pillars of security practice are complete. Recapping today’s sequence: ① download the ISO → ② create the VM (allocate resources) → ③ install from the ISO → ④ update → ⑤ snapshot the clean state → ⑥ experience breaking/restoring.

Two closing words of advice. First, the freedom of this lab exists inside the lab only. "It’s safe inside the virtual machine" and "it’s okay to attack other people’s systems outside the lab" are entirely different statements, and only your own principles keep the latter in check. Second, a VM can be exported and imported as a single file (.ova), and the security education community has a culture of distributing whole "practice vulnerable VMs." Famous targets like Metasploitable, which you’ll meet later, are the same kind of virtual machine you made today.

Before installing something or making a big change, ask yourself: "Did I take a snapshot?" That one sentence will save you countless hours ahead.

Once every box is checked, Step 17 is complete. Click the checkbox in the sidebar to save your progress.