Live VM server forensic acquisition

My experience with vSphere is superficial, but I think only a snapshot will create dedicated RAM dumps (VMSN and VMEM files), not a suspend operation.

I'd avoid doing anything on the machine in general. The network connection should definitely not be interrupted (if not absolutely necessary for network security).

Thanks for your reply.

Regarding the network, you cannot know if the attacker is exfiltrating data at the very moment you discover it. Based on this, wouldn't it make more sense to take a snapshot of the memory asap and then drop the connection? This way you will have the memory dump to investigate the active connections at the moment of acquisition and also minimize damage by blocking further access to the server.

Thanks for your reply.

Regarding the network, you cannot know if the attacker is exfiltrating data at the very moment you discover it. Based on this, wouldn't it make more sense to take a snapshot of the memory asap and then drop the connection?

Yes, that's what I meant to say. Exfiltration is not a network security concern in this sense (only danger for other machines). The active connections are usually known from network monitoring, but RAM can help, of course. What I had in mind non-persistent malware will often blot out its traces, if you cut the connection.

A side note on provisioning and how it changes procedures

While a full VMDK can be mounted and explored, i'm not sure that one that uses provisioning can be explored with forensic tools, only way to do that then is to fire it up on a separate host, then mount the drive(s) over the network and explore through that.

https://pubs.vmware.com/vsphere-4-esx-vcenter/topic/com.vmware.vsphere.server_configclassic.doc_41/esx_server_config/managing_storage/c_vstorage_thin_provisioning.html

Some malware will still beacon out if it is designed to do that, so you can capture and identify that over the network.