Hyper-V Memory Forensics - MemProcFS to the Rescue!

A new 13Cubed episode is up!

Learn how to properly acquire memory from Microsoft Hyper-V guest virtual machines.

After I recorded this episode, Ulf Frisk, the author of MemProcFS, let me know that he has made some updates that no longer require you to copy the vmsavedstatedumpprovider.dll file to the MemProcFS directory if the SDK is installed in the \*\*\*default\*\*\* location. If installed to a different location, the file must still be copied. Additionally, the requirement to prepend the Hyper-V …

author computerforensics copy directory dll dll file file forensics hyper-v learn machines memory memory forensics microsoft rescue updates virtual virtual machines