No, RAM dumps are not "normal VM activity". These files are created in the circumstances already discussed above.xLoris wrote: My guess is that these .sav files are created during normal VM activity
p.s. "VDI machine" is not correct. A VDI is just a disk image (i.e. storage). A PC consists of more than just the disk drive, it's the entire virtual PC that is considered "the machine". This isn't just a technicality: people who base their procedures on the bad assumption that the VDI is the only important file (because it's the largest) are exactly the people who get into these troubles.