http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/wiki/Encrypted_Images
Powered-down VMs After a VM has shutdown, the RAM that previously contained the VM's encryption key might not have been wiped yet. Memory pages belonging to a terminated process do not have their contents wiped (zeroed) until they are about to be used by another process. [ 2 ] [ 3 ] [ 4 ] [ 5 ] Swap An encrypted swap provides no protection so long as the host is powered up, because the key is still in RAM.