The .vmss
file (VMware Snapshot State) is a proprietary format used by VMware virtualization software to save the state of a virtual machine (VM) at a specific point in time. This is not a raw memory (like .dd
or .mem
). Therefore, it has to be extracted before performing forensic.
# Using vmss2core
vmss2core -W Target1-1dd8701f.vmss