Exploring popular acquisition tools and techniques
The creation of a memory dump is not a trivial task and depends on several factors. We will discuss all of them individually in this part of the chapter.
Virtual or physical
The environment plays an important role in the process of dump creation. This is due to the fact that no additional tools are required to dump virtual machine memory.
In fact, the contents of the virtual machine's memory are partially or completely placed in a file with a certain extension, so getting a dump is reduced to getting that exact file. The following screenshot shows the basic virtualization tools and files used to store virtual machine memory:
An important criterion in obtaining virtual machine memory is its state. It is necessary to understand that if the virtual machine is running, the contents of the memory are constantly changing...