James has to perform a forensic investigation of a running virtual machine (VM). What forensic evidence should he collect?

Forensic investigation of virtual machines generally depends on obtaining a snapshot using the virtualization platform's built-in snapshot features. This approach captures both the memory state and the disk for the system and can be examined using forensic tools or run on a separate system.