skills.rest
leonardoteodoroo
leonardoteodorooCOMMUNITY
Explore all skills by this author →
GitHub

memory-forensics

Analyze volatile memory artifacts from RAM dumps with Volatility 3.

Updated Feb 3, 2026
Search Tags:#forensics#incident-response#malware-analysis#memory-forensics#artifact-extraction#volatility3#ram-dump
One-click install
npx skills add https://github.com/leonardoteodoroo/amino-advanced --skill memory-forensics-leonardoteodoroo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: memory-forensics
Source: https://github.com/leonardoteodoroo/amino-advanced/tree/main/.agent/skills/memory-forensics
Command: npx skills add https://github.com/leonardoteodoroo/amino-advanced --skill memory-forensics-leonardoteodoroo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a comprehensive guide to memory forensics, enabling investigators to acquire RAM dumps, analyze processes, and extract artifacts for incident response and malware analysis.

Core Features & Use Cases

  • Memory acquisition across live and VM environments, with cross-platform commands for Windows, Linux, and macOS.
  • Artifact extraction and analysis: memory artifacts, processes, network artifacts, DLLs, registry-like data.
  • Malware and incident response workflows: step-by-step workflows for malware analysis in memory and memory-based investigations.

Quick Start

Acquire a RAM dump from the target system and load it into Volatility 3 to begin basic process and artifact analysis.

Frequently Asked Questions about memory-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a RAM dump for incident response and malware analysis?▼

To analyze a RAM dump for incident response, you load the memory image into Volatility 3 and run plugins to extract processes, network artifacts, and DLLs. This Skill provides step-by-step workflows to identify volatile artifacts and investigate malware.

What is the best way to extract processes and network artifacts from a memory dump?▼

Extracting processes and network artifacts from a memory dump requires loading the image into Volatility 3 with the appropriate symbol files. This Skill guides you through running specific plugins to pull registry-like data, DLLs, and active connections.

Does memory forensics with Volatility 3 work on Linux and macOS memory images?▼

Yes, memory forensics with Volatility 3 supports Windows, Linux, and macOS memory images. This Skill provides cross-platform commands for memory acquisition and artifact extraction across all three operating systems.

How do I acquire a RAM dump from a live system or virtual machine environment?▼

Acquiring a RAM dump from a live system or VM involves running specific memory acquisition commands. This Skill offers cross-platform commands for Windows, Linux, and macOS to capture volatile memory before analysis begins.

Do I need symbol files to run Volatility 3 plugins on a memory image?▼

Yes, you need appropriate symbol files alongside Volatility 3 and your memory dump to run plugins effectively. This Skill requires these dependencies to accurately extract and analyze volatile artifacts from the target memory image.

Related Skills

Explore More Education & Research Skills→
YukiIto1999YukiIto1999

performing-memory-forensics-with-volatility3

Analyze volatile memory dumps with Volatility 3 to extract processes and malware artifacts.

Community
Advanced
bpnrockstarbpnrockstar

forensics

Analyze disk images, memory dumps, and packet captures for incident response.

Community
Advanced
as4584as4584
2

memory-forensics

Analyzes volatile memory dumps using Volatility 3 to extract processes, networks, and artifacts.

Community
Advanced
kiwamizamuraikiwamizamurai
7

forensics

Extract hidden data and forensic artifacts from files using standard tools.

Community
Advanced