Agent skill · security · aiskillstore
memory-forensics
Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
Why this skill is useful
Adds detailed executable commands and workflows for memory forensics using Volatility that are not commonly known or documented.
What it needs
Requires volatility3 installed locally. About 6k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Memory Forensics Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis. Use this skill when Working on memory forensics tasks or workflows Needing guidance, best practices, or checklists for memory forensics Do not use this skill when The task is unrelated to memory forensics You need a different domain or tool outside this scope Instructions Clarify goals, constraints, and required inputs. Apply relevant best practices and validate outcomes. Provide actionable steps and verification. If detailed examples are required, open resources/implementation-playbook.md. Memory Acquisition Live Acquisition Tools Windows Linux macOS Virtual Machine Memory Volatility 3 Framework Installation and Setup Essential Plugins Process Analysis Network Analysis DLL and Module Analysis Memory Injection Detection Registry Analysis File System Artifacts Linux Analysis macOS Analysis Analysis Workflows Malware Analysis Workflow Incident Response Workflow Data Structures Windows Process Structures VAD (Virtual Address Descriptor) Detection Patterns Process Injection Indicators Rootkit Detection Credential Extraction YARA Integration Writing Memory YARA Rules Scanning Memory String Analysis Extracting Strings FLOSS for Obfuscated Strings Best Practices Acquisition Best Practices 1. Minimize footprint: Use lightweight acquisition tools 2. Document everything: Record time, tool, and hash of capture 3. Verify integrity: Hash memory dump immediately after capture 4. Chain of custody: Maintain proper forensic handling Analysis Best Practices 1. Start broad: Get overview before deep diving 2. Cross-reference: Use multiple plugins for same data 3. Timeline correlation: Correlate memory findings with disk/network 4. Document findings: Keep detailed notes and screenshots 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/memory-forensics