.VMEM File Format

Introduction

A .vmem file holds the RAM of a running VMware virtual machine, or the RAM at the time a snapshot was taken (<name>.vmem or <name>-Snapshot<##>.vmem, from VMware's article on the contents of a Fusion bundle). It is the guest's physical memory as raw bytes.

Structure

The file has no header and no structure of its own. Where each run of it belongs in the guest's physical address space is recorded in the .vmss or .vmsn file with the same name. Volatility 3's stacker looks for <name>.vmss and then <name>.vmsn beside the .vmem; with neither it gives up on the file as a VMware layer (it warns that "a VMSS or VMSN file may be required"). With one, each region i of the memory group maps guest physical address regionPPN[i] × 4096 onto offset regionPageNum[i] × 4096 of the .vmem, for regionSize[i] × 4096 bytes. Volatility 3 refuses a .vmem whose state file has no regions ("not split into regions"); the older Volatility 2 reads that case as one run from address 0.

The viewer shows the size in pages and, when the state file was opened with it (a dropped folder), the memory runs it lists. It does not interpret the memory.

Not described

Unknown

• Viewer: the content of the memory (page tables, kernel structures) is not interpreted: that is memory forensics, and depends on the guest operating system.
• Reference: VMware has published nothing about the file; the mapping above is Volatility's.

Links