No need to get that fancy. If they're in the cloud, they're most likely on Xen, which natively supports full memory dumps. LE goes to the cloud provider with a warrant, they run "sudo xm dump-core", LE walks away with a memory dump without the client ever knowing anything.