Answer by AI module.
Step-by-step (all in dom0, as root where noted)
1. Freeze and cut connectivity.
qvm-pause <dispvm>
Since the qube is paused and can’t react anyway, the safest way to cut the network is to deal with the parents, not the paused child — e.g. pause or stop sys-firewall (and optionally sys-net), or drop the netvm property if the tooling allows it on a paused qube.
2. Dump the RAM.
Xen’s xl tool (available in dom0) writes guest RAM to an ELF core file:
xl list # note the domid/name of the disposable
xl dump-core <domid-or-name> /home/user/disp-incident.core
Check first that dom0 has enough free space (df -h /home/user) — the file is roughly the qube’s allocated memory in size. This writes to dom0 storage, which is why it should be treated as a last-resort forensic move, not routine cleanup.
3. Dump the disk volumes.
Each qube’s volumes are logical volumes named like vm-<name>-root and vm-<name>-private. Locate and copy them read-only:
sudo lvs | grep <name> # find the volume paths
sudo dd if=/dev/<vg>/vm-<name>-root of=/home/user/disp-root.img bs=4M status=progress
sudo dd if=/dev/<vg>/vm-<name>-private of=/home/user/disp-private.img bs=4M status=progress
Copying (rather than moving) leaves the original evidence intact — important for a disposable, since its volumes are destroyed the moment the qube shuts down or is removed.
4. Transfer for analysis.
Copy the files out of dom0 to an analysis machine (via qvm-copy into a dedicated air-gapped vault qube and then external media, or via encrypted removable storage).
End of AI content
Anyone can double check AI suggestion?