Skip to main content Link Menu Expand (external link) Document Search Copy Copied

dfir / memdump

windows

linux

  • [LinPMEM](https://github.com/Velocidex/Linpmem]

virtualbox

# STEP 1: launch the VM in debug mode using CLI
> vboxmanage list vms
> virtualbox  --dbg --startvm <VM name>
# STEP 2 : click on the "Debug" menu -> "Command line...". VBoxDbg > .pgmphystofile   <VM name>.mm
#

libvirt

Libvirt supports Xen, Qemu, KVM, OpenVZ, virtualbox, VMware ESX and LXC hypervisors.

#? dump memory via libvirt
#
# STEP 1: launch ```virsh``` which is the interface management:
#
$ virsh
virsh # dump --memory-only -domain 1 --file sample-dump.dmp
virsh # exit
$ ls
sample-dump.dmp
#