Virtual Machines Memory Forensics

Jason Hale talks about Memory Acquisition and Virtual Secure Fashion. «Physical memory is commonly acquired using a software-based memory acquisition tool such as winpmem, DumpIt, Magnet RAM Capturer, FTK Imager, or one of the several other options available. These tools typically load a device driver into the kernel and subsequently read memory through mapping the \\Device\PhysicalMemory object, using a function such as MmMapIoSpace, or directly manipulating the page tables. Many of these tools also share a similar trait: their use on a system with virtual secure mode enabled results in a system crash.».

Jason tested most of the memory collection tools in a system with enabled VSM, which leads to a system crash shortly after loading the data collection driver. The tested tools include multiple versions of winpmem, Magnet RAM Capturer, FTK Imager, and older versions of DumpIt. He also lists some of the unsuccessful tools he identified.

We hope this article will be useful for you. After all, it also lists the tools that were checked and not verified because of licensing problems or otherwise.

More.