Virtual Machine / Linux memory - Vol-users - volatilityfoundation.org

Virtual Machine / Linux memory

DFIR interview on healthy paranoia

Memory Forensics Training by...

Lou LaRocca

5 Jul 2013 5 Jul '13

12:29 p.m.

Maybe a stupid question here but does Volatility currently support the analysis of linux memory from a Virtual Machine? I see that it supports VM's and Linux separately but not together? Thanks in advance Lou

Attachments:

attachment.html (text/html — 286 bytes)

Reply

Show replies by date

Jamie Levy

5 Jul 5 Jul

1:23 p.m.

Hi Lou, There are no stupid questions. Yes, Volatility will support linux memory from a Virtual Machine. If you have VMWare, the *.vmem file is just a copy of RAM. We also support VMWareSnapShot files: http://code.google.com/p/volatility/wiki/VMwareSnapshotFile and VirtualBox: http://code.google.com/p/volatility/wiki/VirtualBoxCoreDump All the best, -gleeda On Fri, Jul 5, 2013 at 12:29 PM, Lou LaRocca <louislarocca(a)gmail.com> wrote:

Maybe a stupid question here but does Volatility currently support the analysis of linux memory from a Virtual Machine? I see that it supports VM's and Linux separately but not together? Thanks in advance Lou _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

-- PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92

Reply

Lou LaRocca

2:10 p.m.

Awesome, thank you! — Sent from Mailbox for iPhone On Fri, Jul 5, 2013 at 1:23 PM, Jamie Levy <jamie.levy(a)gmail.com> wrote:

Hi Lou, There are no stupid questions. Yes, Volatility will support linux memory from a Virtual Machine. If you have VMWare, the *.vmem file is just a copy of RAM. We also support VMWareSnapShot files: http://code.google.com/p/volatility/wiki/VMwareSnapshotFile and VirtualBox: http://code.google.com/p/volatility/wiki/VirtualBoxCoreDump All the best, -gleeda On Fri, Jul 5, 2013 at 12:29 PM, Lou LaRocca <louislarocca(a)gmail.com> wrote:

Maybe a stupid question here but does Volatility currently support the analysis of linux memory from a Virtual Machine? I see that it supports VM's and Linux separately but not together? Thanks in advance Lou _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

-- PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92

Reply

Sina Manavi

6 Jul 6 Jul

2:46 p.m.

I wanted to focus my master thesis research on this area, but I found out that, Volatility do all the staff it vmem as it can does, on other dd memrory dumps from physical machine as well . thanks Volatility that , it force me to change my topic, Vol team strongly are working on it, I couldntfind any contribution on it :) On Sat, Jul 6, 2013 at 12:29 AM, Lou LaRocca <louislarocca(a)gmail.com> wrote:

Maybe a stupid question here but does Volatility currently support the analysis of linux memory from a Virtual Machine? I see that it supports VM's and Linux separately but not together? Thanks in advance Lou _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

-- _______________________________________________________________ Master of Computer Science Security in Computing (University of Putra Malaysia) Manavi.Sina(a)gmail.com 0060-11-12-27-41-83 http://sinamanavi.blogspot.com/p/about-me.html

Reply

4149

days inactive

4150

days old

vol-users@lists.volatilityfoundation.org

Manage subscription

3 comments

3 participants

tags (0)

participants (3)

Jamie Levy
Lou LaRocca
Sina Manavi