4

in spite of the fact that the main point of virtualization is having "containerized" environments for every instanced OS without sharing memory space, are there techniques to make forensics on either online or offline (paused) virtual machines?

Question is biased towards the fact I hope there is no such possibility, but than again, my concern is the fact that, in very layman's terms, when you pause your virtual machine, memory should be "dumped" somewhere on the host in order to restore it later.

Is it possible to access (read only) sensitive information from the VM in that case? If so, are there mitigation procedures for such events and how should they be properly applied?

With my very best,

Bruno

Improve this question

2 Answers 2

Reset to default
5

Virtual machine physical memory is usually presented as a file on a host operating system.

For Hyper-V – VMRS files in VM folder. There is also a converter from Microsoft - https://github.com/CSS-Windows/WindowsDiag/tree/master/SHA/vm2dmp

For ESXi – VMEM files. Here is a description, how to convert to dmp - https://support.arcserve.com/s/article/206136986?language=en_US

Improve this answer
2

You should assume yes.

It varies depending on the product. For example, Hyper-V production checkpoints do not include memory. For VMWare, creating a snapshot and extracting the memory is fairly trivial.

Mitigations will also vary depending on the product. Microsoft Hyper-V 2016 and higher has Shielded VM's/Virtual TPM/BitLocker. VMWare VSphere 6.7 and higher has VM-level disk encryption/encrypted VMotion/Virtual TPM, although I'm not sure if it has feature-parity with Shielded VM's but it's certainly better than not using it.

I'm not aware of any other hypervisors on the market with this capability.

Improve this answer
2
  • Hi, thank you for your quick answer. Just to make sure, since you were mentioning BitLocker and similar techniques - I was inquiring exclusively in respect to memory - RAM, meaning process address spaces and such. To put it very bluntly - if I have C based software that takes input from console and saves data in the RAM, if I pause (or do it on live instance) VM, would I be able to (theoretically) read it somehow?
    – bbanelli
    Mar 30, 2020 at 14:49
  • 1
    @bbanelli: Yes that is correct.
    – Greg Askew
    Mar 30, 2020 at 15:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .