VirtualBox Memory File

[jasonreeza]

Hey folks,

I've done some searching and can't seem to find documentation on where VirtualBox stores guest memory files (similar to VMware's .vmem). When VirtualBox guest machines are suspended, where can I find the memory dump on the host machine's disk? I appreciate any pointers you can offer.

Thanks.

[Perryg]

Look in the Machine folder -> name of VM -> snapshots. IIRC it is called *<uuid>.sav

[jasonreeza]

Thanks. I've allocated 512 MB for the VM's RAM so I was expecting to find a file that was 512 MB on the host's disk. The *.sav file I have is much less than 512 MB so I guess VirtualBox only saves the amount of memory currently in use by the guest (rather than VMware that stores the entire 512 MB, even if the guest isn't using it all).

Are you aware of any existing programs that can convert the *.sav file to a standard memory dump format so that they can be analyzed in memory forensics tools?

[Verb]

Not to bump an old thread, but I have the exact same question for the same reason as jasonreeza.

I know you can convert VB disk images to VMware images, but is there anyway to convert the .sav memory file VB uses to the vmem file VMware uses? Or a way to have VB create .vmem files instead of .sav?

[michaln]

The saved state contains a lot more than just the guest's memory contents. That should be obvious...

I don't think anyone except VMware knows the format of their .vmem files. That kind of puts the kibosh on the whole conversion idea.

Of course the VirtualBox .sav file format is documented (all source code is available), so you could ask VMware to write a conversion tool. I'm sure they'd be amused.