A method of a computing device comprising first and second hardware components interconnected by a packet-based memory fabric, the method comprising: determining, with a resource controller of the computing device, to take a snapshot of memory accessible to the first component via a memory controller, the memory controller mapping location identifiers (IDs) to initial memory locations of the accessible memory for the first component; in response to the determination and with the resource controller, configuring the memory controller to treat the location IDs as copy-on-write for the first component and not for the second component independent of the resource controller after the configuring; with the memory controller configured for copy-on-write, and independent of the resource controller: in response to a write packet comprising information identifying the first component as a source and indicating, for a write operation, a given one of the location IDs for which a copy-on-write mapping was not already created for the first component, create a copy-on-write mapping of the given location ID to an alternate memory location for the first component; after creating the copy-on-write mapping and in response to a read packet comprising information identifying the second component as a source and indicating, for a read operation, the given location ID, returning data stored in the initial memory location to which the given location ID is mapped for the second component; and after the configuring, executing simultaneously at least a portion of an operating system, virtual machine, or hypervisor with the first component and at least a portion of a forensic analysis system with the second component, without modifying the snapshot comprising initial data stored in the initial memory locations at the time of the configuration, and with each of the first and second components attempting to access multiple of the initial physical memory locations using the location IDs. determining, with a resource controller of the computing device, to take a snapshot of memory accessible to the first component via a memory controller, the memory controller mapping location identifiers (IDs) to initial memory locations of the accessible memory for the first component; in response to the determination and with the resource controller, configuring the memory controller to treat the location IDs as copy-on-write for the first component and not for the second component independent of the resource controller after the configuring; with the memory controller configured for copy-on-write, and independent of the resource controller: in response to a write packet comprising information identifying the first component as a source and indicating, for a write operation, a given one of the location IDs for which a copy-on-write mapping was not already created for the first component, create a copy-on-write mapping of the given location ID to an alternate memory location for the first component; after creating the copy-on-write mapping and in response to a read packet comprising information identifying the second component as a source and indicating, for a read operation, the given location ID, returning data stored in the initial memory location to which the given location ID is mapped for the second component; and after the configuring, executing simultaneously at least a portion of an operating system, virtual machine, or hypervisor with the first component and at least a portion of a forensic analysis system with the second component, without modifying the snapshot comprising initial data stored in the initial memory locations at the time of the configuration, and with each of the first and second components attempting to access multiple of the initial physical memory locations using the location IDs. in response to a write packet comprising information identifying the first component as a source and indicating, for a write operation, a given one of the location IDs for which a copy-on-write mapping was not already created for the first component, create a copy-on-write mapping of the given location ID to an alternate memory location for the first component; after creating the copy-on-write mapping and in response to a read packet comprising information identifying the second component as a source and indicating, for a read operation, the given location ID, returning data stored in the initial memory location to which the given location ID is mapped for the second component; and after the configuring, executing simultaneously at least a portion of an operating system, virtual machine, or hypervisor with the first component and at least a portion of a forensic analysis system with the second component, without modifying the snapshot comprising initial data stored in the initial memory locations at the time of the configuration, and with each of the first and second components attempting to access multiple of the initial physical memory locations using the location IDs.