Snapshot files store
information about the state of the computer. Essentially, snapshots
are a picture of the computer at a point in time. During a policy
run, Symantec ESM compares the current state of the computer to the
one recorded in the snapshot. Symantec ESM then reports any changes
as potential security problems.