Do Azure provide compability to dump full memory from Azure VM for digital forensics?

Question

Do Azure provide compability to dump full memory from Azure VM for digital forensics?

Tim Ip 21

I recently came across a article and it seems there is a way for Azure support to acquire full memory dump.
https://azure.microsoft.com/en-us/support/legal/support-diagnostic-information-collection/

Wonder if there is a way for customer to submit Azure support request to gain access to full memory dump file for digital forensics?

Accepted answer

0 additional answers

Your answer

Answer 1

prmanhas-MSFT 17,946 Microsoft Employee Moderator

@Tim Ip Apologies for the delay in response and all the inconvenience caused because of the issue.

You can refer to below link for more info:

https://heranonazure.wordpress.com/2018/09/26/created-a-dump-for-a-running-vm-in-azure/

Also this thread on Q&A might be helpful as well.

Hope it helps!!!

Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics.

Tim Ip 21 Reputation points

2021-04-27T20:24:16.047+00:00
@prmanhas-MSFT , Thanks for your reply!

We are exploring option for Digital Forensics (To capture memory dump from Azure backend instead of doing it inside VM host).
I have the following questions:

Is there any option for customer to submit support request to gain access to memory dump?

Do customer have access to memory dump capture by Azure support in this document?
https://azure.microsoft.com/en-us/support/legal/support-diagnostic-information-collection/
prmanhas-MSFT 17,946 Reputation points Microsoft Employee Moderator

2021-04-28T09:24:13.403+00:00

@Tim Ip Thank you for your response!!!

Let me check internally and I will keep you posted on update.

Thanks
Tim Ip 21 Reputation points

2021-05-06T03:20:47.287+00:00

Thanks! @prmanhas-MSFT
prmanhas-MSFT 17,946 Reputation points Microsoft Employee Moderator

2021-05-17T09:42:50.863+00:00

@Tim Ip Apologies for all the delay in response and all the inconvenience caused because of the issue!!!

I had discussion internally and they did confirm that customer do not have access to those dumps as per your requirement. There are alot of factors involved which include security reason as well which won't fit with one compliance.

They can guide you through it again condition being that you have some privileged Admin. role in directory to do so but that can be suggested over call with Support.

Hence I would suggest you to open Support Request if you need further explanation and have support Plan in place otherwise do let me know I can enable One Time Free Technical Support for you.

Hope it helps!!!

Please "Accept as Answer" if any of above helped so it can help others in community looking for help on similar topics.
Tim Ip 21 Reputation points

2021-05-18T17:33:48.317+00:00

Thanks for your information.

Share via

Do Azure provide compability to dump full memory from Azure VM for digital forensics?

0 additional answers

Your answer