9:34 a.m.
Hi,
what's the preferred virtualization method to create memory dumps? Is it possible to
acquire the guest memory without guest modifications? Linux and Windows guests are used.
Regards,
Chris
9:59 a.m.
I've had no problems using Virtualbox and Linux guests. It's as simple
as using the vboxmanage debugvm command to acquire the memory.
On 28 September 2013 15:34, <chris-2012(a)arcor.de> wrote:
Hi,
what's the preferred virtualization method to create memory dumps? Is it possible to
acquire the guest memory without guest modifications? Linux and Windows guests are used.
Regards,
Chris
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
11:52 a.m.
Op 28-9-2013 15:59, Edwin Smulders schreef:
I've had no problems using Virtualbox and Linux
guests. It's as simple
as using the vboxmanage debugvm command to acquire the memory.
I'm trying to get (haven't spent that much time yet) libvmi to work with
KVM.
Reasons:
- Live analysis: no need for a dump , you can map the memory directly to
your host os
- I prefer KVM over virtualbox personally.
Cheers,
Boudewijn
12:13 p.m.
Stick with libvmi, it holds promise. Sure vmware and VirtualBox still have their place,
but from what you are expressing libvmi is the root you need to go.
________________________________
From: Boudewijn Ector <boudewijn(a)boudewijnector.nl>
To: vol-users(a)volatilityfoundation.org
Sent: Saturday, September 28, 2013 4:52 PM
Subject: Re: [Vol-users] Linux Virtualization KVM or VirtualBox?
Op 28-9-2013 15:59, Edwin Smulders schreef:
I've had no problems using Virtualbox and Linux
guests. It's as simple
as using the vboxmanage debugvm command to acquire the memory.
I'm trying to get (haven't spent that much time yet) libvmi to work with
KVM.
Reasons:
- Live analysis: no need for a dump , you can map the memory directly to
your host os
- I prefer KVM over virtualbox personally.
Cheers,
Boudewijn
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
4065
days inactive
4065
days old
vol-users@lists.volatilityfoundation.org
3 comments
4 participants
participants (4)
-
Boudewijn Ector -
chris-2012＠arcor.de -
Echo6 -
Edwin Smulders