criu has been used for live migration for a while.

Getting a consistent snapshot that you can restore reliably is a hard problem but probably not as big deal for forensic analysis.