A system and method for inspecting a virtual appliance runtime environment is provided. In particular, runtime activity within a virtual machine may be monitored and tracked to manage a file system associated with the runtime activity. For example, a new image having a pointer to a base image being executed may be created, wherein the new image may be empty when created, and wherein data may be written to the new image in response to any files being created, deleted, modified, or otherwise accessed during execution of the base image within the virtual machine. Thus, a file system for the new image may be compared to a file system for the base image to analyze the runtime activity for the base image, wherein the new image may preserve runtime changes to the file system and provide visibility into particular runtime modifications to the file system.