Is it possible to acquire forensic image of a VPS without rebooting it ? Are any signs to an end user that it's VPS was imaged by the VPS provider ?

  • Do you mean creating a snapshot for the VPS? – mootmoot Jul 29 '16 at 17:09
  • @mootmoot yes copying disk image – sektor Jul 29 '16 at 17:21
  • 1
    Check your cloud service provider terms and condition. Don't use them if you don't trust them. Yes, it is possible to create snapshot without shutting down, you can even do that with Virtualbox. – mootmoot Jul 29 '16 at 17:25
  • Well, some cloud services allow you to encrypt the snapshot. But.....well, it is about trust. – mootmoot Jul 29 '16 at 18:00
  • Many VPS providers allow you to access the console from where you can perform manual installation via PXE boot. This way you can install Linux from over internet (from mirror) and choose encrypted filesystem which makes imaging futile. The only thing they will be to do would be taking RAM snapshot and reading the key which is a bit harder. – Aria Jul 29 '16 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.