Excellent point. I highly doubt a VPS provider would volunteer a memory dump of a VM when presented with a search warrant for a copy of the VM. Most providers would likely just copy the VM files and call it a day.