A very brief post, just a reminder about a very useful volatility feature.
The process on a VMware machine is more simple than VirtualBox, just 4 simple steps:
- Suspend the virtual machine
- Navigate to the virtual machine’s directory and identify the *.vmem file
- Copy the vmem image to you analysis workstation
- Finally use the following Volatility command to convert the memory image to a dump ready for analysis:
$ volatility -f memory_image.vmem -O raw_image --profile=Win8SP0x86 raw2dump
Now the memory dump can be analyzed with the usual methods.