Memory forensics

[Root_User]

Is it possible to inspect the current memory traffic outside the VM?  This would supply me with valuable insight without tampering with installed VM OS.

[wila · Accepted solution]

Hi,

Not exactly sure what you are after, but ... when you take a snapshot, the memory is written out to a file called <machine name>.vmss

Perhaps that will help?

--

Wil

[admin]

As wila mentioned, you can use snapshots to write the VM memory to disk.  You also can suspend the VM.  You then could use the vmss2core tool to convert it to a dump file that you could inspect with a debugger.