Analysis of a (suspended) vmware session file (Re: vmware for dummies)

[Rob J Meijer <rmeijer () xs4all nl>]

The section "Examining data in memory" of this page is verry interesting.
Does anyone know if there are any libs, tools or specs available that
could be used in doing analysis on suspended vmware sessions, without actualy
restarting the session and installing and running pcat (ctk), as that
whould defeat the whole concept of using suspended sessions in a forensicaly
sound way.

T.I.A.

Rob J Meijer

On Sat, 8 Nov 2003, Byron Sonne wrote:

> > I would appreciate anyone supplying a link or a paragraph/definition of
> > "vmware" as it relates to honeypots for my current undergrad research
> > paper.
>
> http://www.seifried.org/security/ids/20020107-honeypot-vmware-basics.html
>
> Google is your friend.
>
> --
>
>       For good, return good. For evil, return justice.