Hi Lou, There are no stupid questions. Yes, Volatility will support linux memory from a Virtual Machine. If you have VMWare, the *.vmem file is just a copy of RAM. We also support VMWareSnapShot files: http://code.google.com/p/volatility/wiki/VMwareSnapshotFile and VirtualBox: http://code.google.com/p/volatility/wiki/VirtualBoxCoreDump All the best, -gleeda On Fri, Jul 5, 2013 at 12:29 PM, Lou LaRocca <louislarocca(a)gmail.com> wrote: -- PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92

I wanted to focus my master thesis research on this area, but I found out that, Volatility do all the staff it vmem as it can does, on other dd memrory dumps from physical machine as well . thanks Volatility that , it force me to change my topic, Vol team strongly are working on it, I couldntfind any contribution on it :) On Sat, Jul 6, 2013 at 12:29 AM, Lou LaRocca <louislarocca(a)gmail.com> wrote: -- _______________________________________________________________ Master of Computer Science Security in Computing (University of Putra Malaysia) Manavi.Sina(a)gmail.com 0060-11-12-27-41-83 http://sinamanavi.blogspot.com/p/about-me.html