Hyper-V Memory Forensics - MemProcFS to the Rescue!

Learn how to properly acquire memory from Microsoft Hyper-V guest virtual machines.

🎉 Update

After I recorded this episode, Ulf Frisk, the author of MemProcFS, let me know that he has made some updates that no longer require you to copy the vmsavedstatedumpprovider.dll file to the MemProcFS directory if the SDK is installed in the ***default*** location. If installed to a different location, the file must still be copied. Additionally, the requirement to prepend the Hyper-V checkpoint file with hvsavedstate:// …

author copy directory dll dll file file forensics hyper-v learn machines memory memory forensics microsoft rescue sdk update updates virtual virtual machines