forensics

Memory forensics on a memory dump uses Volatility 3 to examine system memory and uncover suspicious activity. This Skill automates memory profiling to extract running processes and artifacts for incident response and post-mortem analysis.

Timeline analysis can be conducted on raw disk images using Plaso to reconstruct file modification events. This Skill leverages Plaso to build a chronological timeline of system activity for post-mortem investigation.

Analyzing packet captures for incident response is best done using tshark for network traffic inspection. This Skill uses tshark to examine packet captures, extract IOCs like IPs and domains, and identify suspicious network communications.

This digital forensics workflow supports file carving to retrieve files from disk images without metadata. It extracts files directly from raw disk images, assisting in compromised system investigation when standard file system structures are damaged.

You need Plaso, Volatility 3, and tshark installed to extract IOCs such as IPs, domains, and hashes. These dependencies are required for the Skill to perform full artifact, memory, and network forensics analysis.