2 Replies Latest reply on Mar 19, 2019 12:10 PM by Nippon87

    Capture live RAM from VSphere. Do the VMs in VSphere create .vmem files?

    Nippon87 Lurker

      I'm unfamiliar with VSphere and have been searching for an answer to this but haven't been able to find it.

      In VMWare workstation player, the VMs create .vmem files while running that contain the "RAM" and you're able to copy these files to perform forensics.

      Does VSphere create the same .vmem file in the directory of the virtual machine?