-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Practical Memory Forensics
By :

The creation of a memory dump is not a trivial task and depends on several factors. We will discuss all of them individually in this part of the chapter.
The environment plays an important role in the process of dump creation. This is due to the fact that no additional tools are required to dump virtual machine memory.
In fact, the contents of the virtual machine's memory are partially or completely placed in a file with a certain extension, so getting a dump is reduced to getting that exact file. The following screenshot shows the basic virtualization tools and files used to store virtual machine memory:
Figure 2.8 – Virtualization tools and files containing memory-related data
An important criterion in obtaining virtual machine memory is its state. It is necessary to understand that if the virtual machine is running, the contents of the memory are constantly changing...
Change the font size
Change margin width
Change background colour