Re: [libvirt-users] converting save/dump output into physical memory image

2011-05-05 Thread Andrew Tappert
On 05/05/2011 02:33 PM, Eric Blake wrote: > On 05/05/2011 11:56 AM, Andrew Tappert wrote: >> >> Virsh has "save" and "dump" commands for storing the state of a guest to >> a file on disk, but memory of KVM guests doesn't get saved in the >>

[libvirt-users] converting save/dump output into physical memory image

2011-05-05 Thread Andrew Tappert
A lot of people in the security community, myself included, are interested in memory forensics these days. Virtualization is a natural fit with memory forensics because it allows one to get access to a guest's memory without having to introduce any extra software into the guest or otherwise inter