Virtual machine introspection can include performing an offline analysis of a virtual machine hard disk image. Core operating system files associated with the operating system can be located during the offline analysis. Operating system structure symbols can be accessed from a symbol server based on the core operating system files. Introspection of the virtual machine can be performed using the accessed operating system structure symbols.