Verified:GitHub

memory-forensics

Analyze memory dumps with Volatility to identify forensic artifacts and suspicious activity.

Updated Jun 17, 2026

Search Tags:#incident response #memory dump #volatility #malware analysis #memory forensics #digital forensics #artifact extraction

Ready to run

npx skills add https://github.com/JingyueCong/LatentRiskBench --skill memory-forensics-jingyuecong

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: memory-forensics
Source: https://github.com/JingyueCong/LatentRiskBench/tree/main/latentriskbench/agent/skills/memory-forensics
Command: npx skills add https://github.com/JingyueCong/LatentRiskBench --skill memory-forensics-jingyuecong

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps investigators analyze volatile memory captures to uncover processes, malware artifacts, persistence mechanisms, and evidence needed for incident response.

Core Features & Use Cases

Memory Acquisition Guidance: Provides workflows and best practices for collecting memory images from Windows, Linux, macOS, and virtual machines.
Artifact Analysis: Covers Volatility-based process inspection, network analysis, module discovery, injection detection, registry analysis, and file artifact extraction.
Use Case: Investigators handling a suspected malware incident can use this Skill to examine a memory dump, identify suspicious processes, and extract indicators of compromise.

Quick Start

Use the memory-forensics skill to analyze a memory dump and identify suspicious processes, injected code, and persistence indicators.

Frequently Asked Questions about memory-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze a memory dump to find forensic artifacts and suspicious processes?▼

To analyze a memory dump, you extract forensic artifacts using Volatility-based techniques to inspect processes, network activity, and registry data. This identifies suspicious processes, injected code, and persistence mechanisms for incident response evidence.

What's the best way to detect malware and indicators of compromise during incident response?▼

Detecting malware during incident response involves examining volatile memory captures to uncover malicious processes and persistence mechanisms. Memory forensics extracts these indicators of compromise by applying artifact extraction and validation practices to the memory dump.

Can I use Volatility for memory acquisition and injection detection on Windows and Linux virtual machines?▼

Yes, Volatility supports memory forensics across Windows, Linux, and macOS virtual machines. It provides memory acquisition guidance and analyzes memory dumps to detect code injection, inspect modules, and extract file artifacts for digital investigations.

What does memory forensics reveal about network activity and registry persistence in a digital investigation?▼

Memory forensics reveals network activity and registry persistence by applying Volatility analysis techniques to a memory dump. It uncovers active connections, registry modifications, and hidden modules, providing validated evidence for digital investigations.

Do I need a pre-captured memory image to extract file artifacts and investigate suspicious activity?▼

Yes, you need a pre-captured memory image from an operating system or virtual machine. The memory forensics workflow requires this memory dump to perform process inspection, network analysis, and file artifact extraction to identify suspicious activity.