Agent skill · security · sickn33
memory-forensics
Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.
Why this skill is useful
Adds comprehensive executable scripts and commands for memory forensics that are not widely available in public documentation.
What it needs
Requires volatility3 installed locally. About 6k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
Memory Forensics Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis. Use this skill when Working on memory forensics tasks or workflows Needing guidance, best practices, or checklists for memory forensics Do not use this skill when The task is unrelated to memory forensics You need a different domain or tool outside this scope Instructions Clarify goals, constraints, and required inputs. Apply relevant best practices and validate outcomes. Provide actionable steps and verification. Memory Acquisition Live Acquisition Tools Windows Linux macOS Virtual Machine Memory Volatility 3 Framework Installation and Setup Essential Plugins Process Analysis Network Analysis DLL and Module Analysis Memory Injection Detection Registry Analysis File System Artifacts Linux Analysis macOS Analysis Analysis Workflows Malware Analysis Workflow Incident Response Workflow Data Structures Windows Process Structures VAD (Virtual Address Descriptor) Detection Patterns Process Injection Indicators Rootkit Detection Credential Extraction YARA Integration Writing Memory YARA Rules Scanning Memory String Analysis Extracting Strings FLOSS for Obfuscated Strings Best Practices Acquisition Best Practices 1. Minimize footprint: Use lightweight acquisition tools 2. Document everything: Record time, tool, and hash of capture 3. Verify integrity: Hash memory dump immediately after capture 4. Chain of custody: Maintain proper forensic handling Analysis Best Practices 1. Start broad: Get overview before deep diving 2. Cross-reference: Use multiple plugins for same data 3. Timeline correlation: Correlate memory findings with disk/network 4. Document findings: Keep detailed notes and screenshots 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/memory-forensics--c83f87