Abstract: Aspects of the present disclosure relate to retrospective memory analysis. In examples, a historical archive of memory images for an execution environment is maintained. A historical memory image of the historical archive may be evaluated according to a current set of known issues, rather than issues that were known at the time of the memory capture. Accordingly, it may be possible to determine when the execution environment was last in a good environment condition. As another example, it may be possible to determine whether a now-known issue has since been resolved (e.g., such that the issue would not be identified in the current execution environment). Thus, as compared to contemporaneous issue identification techniques, aspects of the present disclosure may be applied to any number of execution environments to enable retrospective identification of now-known issues that were, at least at the time of a memory capture, not known.

Abstract: Aspects of the present disclosure relate to retrospective memory analysis. In examples, a historical archive of memory images for an execution environment is maintained. A historical memory image of the historical archive may be evaluated according to a current set of known issues, rather than issues that were known at the time of the memory capture. Accordingly, it may be possible to determine when the execution environment was last in a good environment condition. As another example, it may be possible to determine whether a now-known issue has since been resolved (e.g., such that the issue would not be identified in the current execution environment). Thus, as compared to contemporaneous issue identification techniques, aspects of the present disclosure may be applied to any number of execution environments to enable retrospective identification of now-known issues that were, at least at the time of a memory capture, not known.

Abstract: Aspects of the present disclosure relate to volatile memory acquisition using live migration of an execution environment. In examples, a virtualization manager controls execution of an execution environment at a virtualization host. The virtualization manager may enable live migration of the execution environment, such that the execution environment may be migrated to another virtualization host (or “migration target”) for continued execution. Accordingly, such functionality may be used to capture a memory image at a migration target, after which the execution environment continues executing at the original virtualization host. The memory image may be analyzed to identify the presence of malware and/or to generate a list of processes that were executing at the time of the capture.