Agent skill · research science · yaklang
memory-forensics-volatility
Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.
Why this skill is useful
Adds detailed executable commands and methodologies for using Volatility 2 and 3 in memory forensics that are not widely documented.
What it needs
Requires volatility installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Memory Forensics — Expert Analysis Playbook AI LOAD INSTRUCTION: Expert memory forensics techniques using Volatility 2 and 3. Covers memory acquisition, OS identification, process analysis (hidden process detection), network connections, DLL/module analysis, code injection detection (malfind), credential extraction, file carving, registry analysis, and timeline generation. Base models miss the Vol2/Vol3 command differences, malware indicator patterns, and Linux-specific memory analysis. 0. RELATED ROUTING Before going deep, consider loading: traffic-analysis-pcap for correlating network artifacts with memory findings steganography-techniques if hidden data suspected in extracted files windows-privilege-escalation for understanding post-exploitation artifacts in memory Quick Reference Also load VOLATILITYCHEATSHEET.md when you need: Vol2 vs Vol3 command comparison table Common plugin sequences for specific investigation types --- 1. MEMORY ACQUISITION Linux Windows Virtual Machines --- 2. VOLATILITY 2 vs 3 Concept Volatility 2 Volatility 3 --- --- --- Profile system --profile=Win10x6419041 Auto-detected (symbol tables) Image info imageinfo windows.info / linux.info Process list pslist windows.pslist Network netscan / connections windows.netscan / windows.netstat DLLs dlllist windows.dlllist Injection malfind windows.malfind Hashes hashdump windows.hashdump Files filescan windows.filescan Registry hivelist / printkey windows.registry.hivelist / windows.registry.printkey Install pip2 install volatility pip3 install volatility3 --- 3. ANALYSIS METHODOLOGY Step 1: Identify OS Step 2: Process Listing — Hidden Process Detection Red flags: Process in psscan but not pslist = DKOM (Direct Kernel Object Manipulation) hiding. Step 3: Network Connections Step 4: DLL / Module Analysis Red flags: DLL in dlllist but False in all three ldrmodules columns = reflective DLL injection. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/memory-forensics-volatility