Andrew Tappert <andrew@...> writes: > > > A lot of people in the security community, myself included, are > interested in memory forensics these days. Virtualization is a natural > fit with memory forensics because it allows one to get access to a > guest's memory without having to introduce any extra software into the > guest or otherwise interfere with it. Incident responders are > particularly interested in getting memory dumps from systems they're > investigating. > I am definitely interested in this concept! I haven't played much yet with memory forensic tools (like Volatility) as atm I'm focusing on other things but I'm planning to switch to it in a very near future. For what I know it's not possible to analyze memory contained in libvirt snapshots taken through qemu savevm. This feature is really powerful under my perspective as it atomically takes the state of the whole machine: disk, memory, processes; everything is saved in the same moment. I am already able to get all the useful information from the disk state: through the qemu convert I can get a qcow2 disk image containing the state of the disk at the moment of the snapshot, through libguestfs I can mount and read this image to see FS changes. I am looking for a similar solution for memory, given a snapshot taken through the savevm command I want to get a file to read through Volatility. _______________________________________________ libvirt-users mailing list libvirt-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvirt-users
