Re: [Vol-users] Analyzing memory from a QEMU snapshot
4 May
2016
4 May
'16
10:35 a.m.
On 04.05.2016 16:25, Adam Pridgen wrote:
Which profile are you using? You should create a
profile for the Linux VM
you are trying to analyze. I have had to do this for several clean
installs of Ubuntu because of Linux kernel versions.
I set up a fresh VM with Debian Linux in the same version the virtual
server was running. Next, I installed the kernel image and related files
extracted from the virtual harddisk on this new VM to get a Linux system
running exactly the same kernel version. Then I created a Volatility
profile on this VM.
- Thomas