Skip to main content
SpringerLink
Log in

Analysis towards VMEM File of a Suspended Virtual Machine

  • Conference paper
Intelligent Computing and Information Science (ICICIS 2011)

Part of the book series: Communications in Computer and Information Science ((CCIS,volume 135))

  • 1241 Accesses

Abstract

With the popularity of virtual machines, forensic investigators are challenged with more complicated situations, among which discovering the evidences in virtualized environment is of significant importance. This paper mainly analyzes the file suffixed with .vmem in VMware Workstation, which stores all pseudo-physical memory into an image. The internal file structure of .vmem file is studied and disclosed. Key information about processes and threads of a suspended virtual machine is revealed. Further investigation into the Windows XP SP3 heap contents is conducted and a proof-of-concept tool is provided. Different methods to obtain forensic memory images are introduced, with both advantages and limits analyzed. We conclude with an outlook.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 159.00
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 209.00
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. Carvey, H.: Windows Forensic Analysis. Elsevier, Amsterdam (2007)

    Google Scholar 

  2. DFRWS 2005 (2005), http://www.dfrws.org/2005/index.shtml

  3. Schuster, A.: Searching for process and threads in Microsoft Windows memory dumps. Digital Investigation (2006)

    Google Scholar 

  4. Intel. Intel 64 and IA-32 Architectures Software Developer’s Manual, vol. 3A (2007)

    Google Scholar 

  5. McDonald, J., Valasek, C.: Practical Windows XP/2003 Heap Exploitation. Blackhat (2009)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Key Laboratory of Information Network Security, Ministry of Public Security, People’s Republic of China (The Third Research Institute of Ministry of Public Security), Shanghai, 201204, China

    Zheng Song, Bo Jin & Yongqing Sun

Authors
  1. Zheng Song
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Bo Jin
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Yongqing Sun
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. The Key Laboratory of Manufacture and Test, Chongqing University of Technology, 400054, Chongqing, P. R. China

    Ran Chen

Rights and permissions

Reprints and permissions

Copyright information

© 2011 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Song, Z., Jin, B., Sun, Y. (2011). Analysis towards VMEM File of a Suspended Virtual Machine. In: Chen, R. (eds) Intelligent Computing and Information Science. ICICIS 2011. Communications in Computer and Information Science, vol 135. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-18134-4_15

Download citation

  • DOI: https://doi.org/10.1007/978-3-642-18134-4_15

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-642-18133-7

  • Online ISBN: 978-3-642-18134-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation