skills.rest
Jhabbig
JhabbigCOMMUNITY
Explore all skills by this author →
GitHub

memory-forensics

Analyze memory dumps with Volatility 3 for forensic evidence.

Updated Apr 5, 2026
Search Tags:#incident response#process analysis#volatility#yara#malware analysis#memory forensics#ram dump
One-click install
npx skills add https://github.com/Jhabbig/Habbig --skill memory-forensics-jhabbig
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: memory-forensics
Source: https://github.com/Jhabbig/Habbig/tree/main/.claude/plugins/wshobson/reverse-engineering/skills/memory-forensics
Command: npx skills add https://github.com/Jhabbig/Habbig --skill memory-forensics-jhabbig

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps incident responders and malware analysts make sense of volatile memory captures when disk artifacts are incomplete, encrypted, or tampered with.

Core Features & Use Cases

  • Acquire or review RAM images from Windows, Linux, macOS, and virtual machines.
  • Inspect processes, process trees, command lines, network sockets, DLLs, injected code, registry hives, files, and kernel modules.
  • Extract indicators like hidden processes, suspicious handles, credentials, strings, and YARA hits to support triage and reporting.
  • Use case: a suspicious endpoint can be analyzed to find the active payload, its connections, and persistence clues even after the malware is removed from disk.

Quick Start

Use the memory-forensics skill to analyze the attached memory image and summarize suspicious processes, network activity, and injected code.

Frequently Asked Questions about memory-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a RAM dump to find hidden processes and injected code?▼

You can analyze a RAM dump by applying Volatility 3 workflows to inspect processes, network sockets, and DLLs. This Skill recovers hidden processes, injected code, and suspicious handles to support malware triage and incident response.

What memory forensics evidence can I recover when disk artifacts are encrypted or tampered with?▼

Memory forensics recovers volatile evidence from RAM dumps, extracting active payloads, network connections, registry artifacts, credentials, and YARA hits even when disk artifacts are incomplete, encrypted, or tampered with.

Does Volatility 3 work with Linux and macOS memory captures, or just Windows?▼

Yes, this Skill applies Volatility 3 workflows to Windows, Linux, and macOS memory captures. You can review processes, kernel modules, network sockets, and registry hives across all three operating systems.

How do I extract YARA scan hits and strings from a memory image?▼

You can extract YARA hits and strings from a memory image by running YARA scanning and string extraction workflows. This Skill identifies indicators like suspicious handles and dumps suspicious memory regions to support reporting.

Can I build an incident response timeline from a memory dump?▼

Yes, you can build an incident response timeline from a memory dump using timeline building workflows. This Skill extracts process activity, network connections, and registry artifacts to reconstruct the sequence of volatile events.

What is the best way to triage malware persistence clues from RAM after the payload is removed from disk?▼

The best way to triage malware persistence from RAM is to analyze the memory dump for active payloads, network connections, and registry artifacts. This Skill recovers these volatile clues even after disk removal.

Related Skills

Explore More Software Engineering Skills→
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced
workromancerworkromancer

web-load2

Fetch web URLs and extract all text content.

Community
Basic
YukiIto1999YukiIto1999

performing-memory-forensics-with-volatility3

Analyze volatile memory dumps with Volatility 3 to extract processes and malware artifacts.

Community
Advanced
do360nowdo360now

forensics-checklist

Automate digital forensic evidence collection and chain of custody documentation.

Community
Advanced