skills.rest
JingyueCong
JingyueCongCOMMUNITY
Explore all skills by this author →
GitHub

memory-forensics

Analyze memory dumps with Volatility to identify forensic artifacts and suspicious activity.

Updated Jun 17, 2026
Search Tags:#incident response#memory dump#volatility#malware analysis#memory forensics#digital forensics#artifact extraction
One-click install
npx skills add https://github.com/JingyueCong/LatentRiskBench --skill memory-forensics-jingyuecong
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: memory-forensics
Source: https://github.com/JingyueCong/LatentRiskBench/tree/main/latentriskbench/agent/skills/memory-forensics
Command: npx skills add https://github.com/JingyueCong/LatentRiskBench --skill memory-forensics-jingyuecong

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps investigators analyze volatile memory captures to uncover processes, malware artifacts, persistence mechanisms, and evidence needed for incident response.

Core Features & Use Cases

  • Memory Acquisition Guidance: Provides workflows and best practices for collecting memory images from Windows, Linux, macOS, and virtual machines.
  • Artifact Analysis: Covers Volatility-based process inspection, network analysis, module discovery, injection detection, registry analysis, and file artifact extraction.
  • Use Case: Investigators handling a suspected malware incident can use this Skill to examine a memory dump, identify suspicious processes, and extract indicators of compromise.

Quick Start

Use the memory-forensics skill to analyze a memory dump and identify suspicious processes, injected code, and persistence indicators.

Frequently Asked Questions about memory-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a memory dump to find forensic artifacts and suspicious processes?▼

To analyze a memory dump, you extract forensic artifacts using Volatility-based techniques to inspect processes, network activity, and registry data. This identifies suspicious processes, injected code, and persistence mechanisms for incident response evidence.

What's the best way to detect malware and indicators of compromise during incident response?▼

Detecting malware during incident response involves examining volatile memory captures to uncover malicious processes and persistence mechanisms. Memory forensics extracts these indicators of compromise by applying artifact extraction and validation practices to the memory dump.

Can I use Volatility for memory acquisition and injection detection on Windows and Linux virtual machines?▼

Yes, Volatility supports memory forensics across Windows, Linux, and macOS virtual machines. It provides memory acquisition guidance and analyzes memory dumps to detect code injection, inspect modules, and extract file artifacts for digital investigations.

What does memory forensics reveal about network activity and registry persistence in a digital investigation?▼

Memory forensics reveals network activity and registry persistence by applying Volatility analysis techniques to a memory dump. It uncovers active connections, registry modifications, and hidden modules, providing validated evidence for digital investigations.

Do I need a pre-captured memory image to extract file artifacts and investigate suspicious activity?▼

Yes, you need a pre-captured memory image from an operating system or virtual machine. The memory forensics workflow requires this memory dump to perform process inspection, network analysis, and file artifact extraction to identify suspicious activity.

Related Skills

Explore More Legal & Compliance Skills→
kiwamizamuraikiwamizamurai
7

forensics

Extract hidden data and forensic artifacts from files using standard tools.

Community
Advanced
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced
as4584as4584
2

memory-forensics

Analyzes volatile memory dumps using Volatility 3 to extract processes, networks, and artifacts.

Community
Advanced
duanbiao2000duanbiao2000
3

memory-forensics

Extract artifacts from Windows, Linux, and macOS memory dumps using Volatility.

Community
Advanced