skills.rest
acaprino
acaprinoCOMMUNITY
Explore all skills by this author →
GitHub

memory-forensics

Analyze memory dumps with Volatility 3 to identify malware artifacts and credential leakage.

6|2|Updated Jan 6, 2026
Search Tags:#forensics#volatility#incident-response#malware-analysis#memory-forensics#ram-dumps
One-click install
npx skills add https://github.com/acaprino/claude-code-daodan --skill memory-forensics-acaprino
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: memory-forensics
Source: https://github.com/acaprino/claude-code-daodan/tree/main/plugins/reverse-engineering/skills/memory-forensics
Command: npx skills add https://github.com/acaprino/claude-code-daodan --skill memory-forensics-acaprino

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Memory forensics enables investigators to acquire and analyze volatile memory from Windows/Linux/macOS to uncover artifacts, malware, credentials, and user activity that may be absent on disk.

Core Features & Use Cases

  • Live memory acquisition across platforms (Windows, Linux, macOS) and RAM image triage.
  • Memory analysis workflows using Volatility 3 to identify processes, network activity, injection, and data remnants.
  • Artifact extraction for incident response and malware analysis (credentials, browser data, registry remnants) with repeatable steps and documentation.

Quick Start

Start by acquiring a live memory snapshot and begin forensic analysis with Volatility 3 to identify processes, network activity, and artifacts.

Frequently Asked Questions about memory-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a RAM dump to find malware artifacts?▼

To analyze a RAM dump for malware artifacts, you acquire a live memory snapshot and use Volatility 3 to triage processes, network activity, and data remnants across Windows, Linux, or macOS environments.

What does memory forensics uncover that disk forensics might miss?▼

Memory forensics uncovers volatile artifacts like active processes, network connections, injected code, credentials, and browser data in RAM that are absent from traditional disk captures.

Can I use Volatility 3 for incident response on both Windows and Linux?▼

Yes, Volatility 3 supports incident response triage across Windows, Linux, and macOS environments to extract processes, network activity, and registry remnants from captured memory images.

How do I extract credentials and browser data from a memory image?▼

To extract credentials and browser data from a memory image, run Volatility 3 artifact extraction workflows on the RAM capture to identify and document remnants of user activity and leaked secrets.

Do I need a separate tool to acquire RAM before using this memory forensics workflow?▼

Yes, you need a memory acquisition workflow to capture a live RAM snapshot before using Volatility 3 to perform process, network, and artifact extraction on the memory dump.

What is the best way to triage volatile memory during a malware investigation?▼

The best way to triage volatile memory during malware analysis is to acquire a RAM snapshot and analyze it with Volatility 3 to identify process injection, network activity, and malicious artifacts.

Related Skills

Explore More Software Engineering Skills→
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced
riparinoriparino
1

defensive-keylogger-detection

Detect keylogger activity using YARA rules and API hook detection.

Community
Advanced
balsm-healthbalsm-health
2

analyzing-memory-dumps-with-volatility

Automate RAM memory dump analysis with Volatility 3 for malware detection.

Official
Advanced
ekremmkasapekremmkasap

memory-forensics

Extracts forensic artifacts from Windows, Linux, macOS memory dumps using Volatility 3.

Community
Advanced