skills.rest
p-o-ke-nae
p-o-ke-naeCOMMUNITY
Explore all skills by this author →
GitHub

memory-forensics

Analyze memory dumps to extract forensic artifacts and identify suspicious activity.

Updated May 16, 2026
Search Tags:#incident response#volatility#yara#malware analysis#memory forensics#artifact extraction#ram dump
One-click install
npx skills add https://github.com/p-o-ke-nae/pokemondamagecalculatorforstory --skill memory-forensics-p-o-ke-nae
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: memory-forensics
Source: https://github.com/p-o-ke-nae/pokemondamagecalculatorforstory/tree/main/.github/skills/memory-forensics
Command: npx skills add https://github.com/p-o-ke-nae/pokemondamagecalculatorforstory --skill memory-forensics-p-o-ke-nae

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you investigate volatile memory captures to uncover hidden processes, injected code, network activity, and other live-system artifacts that are often lost on disk.

Core Features & Use Cases

  • Memory acquisition guidance: Collect RAM images from Windows, Linux, macOS, virtual machines, and cloud-like environments with practical capture options.
  • Volatility-driven analysis: Inspect processes, threads, modules, sockets, registry hives, files, and injected regions using established memory forensics workflows.
  • Incident response and malware hunting: Triage suspicious dumps, confirm process hollowing or injection, extract strings, and run YARA scans to validate findings.

Quick Start

Ask the skill to analyze a memory dump and produce a forensic triage report with suspicious processes, network connections, injection indicators, and recommended next investigation steps.

Frequently Asked Questions about memory-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a RAM dump to find hidden processes and injected code?▼

You can analyze a RAM dump using Volatility-driven workflows to inspect processes, threads, modules, and injected regions, producing a forensic triage report that identifies suspicious activity and live-system artifacts.

What is memory forensics used for during incident response?▼

Memory forensics is used during incident response to uncover volatile artifacts like network sockets, registry hives, and credential data that are often lost on disk, helping triage suspicious dumps and validate findings.

Can I run YARA scans against a memory dump to hunt for malware?▼

Yes, you can run YARA scans against a memory dump to validate malware findings, extract strings, and confirm indicators of compromise like process hollowing or code injection.

Does memory forensics support Linux and macOS RAM captures, or just Windows?▼

Memory forensics supports live acquisition and analysis workflows across Windows, Linux, macOS, and virtual machines, providing practical capture options for various environments.

What's the best way to extract forensic artifacts from a memory image?▼

The best way to extract forensic artifacts from a memory image is using Volatility 3-style analysis capabilities to inspect files, registry hives, network connections, and process structures.

Why should I not rely only on disk forensics when investigating live-system threats?▼

Relying only on disk forensics risks missing volatile data like active network sockets, injected code, and hidden processes, whereas memory forensics captures these live-system artifacts before they are lost.

Related Skills

Explore More Data & Analytics Skills→
kiwamizamuraikiwamizamurai
7

forensics

Extract hidden data and forensic artifacts from files using standard tools.

Community
Advanced
SherifEldeebSherifEldeeb
5

malware-forensics

Analyze malware samples to produce forensic insights and IOC lists.

Community
Advanced
fabioc-alohafabioc-aloha

svg-to-png

Convert SVG files to PNG images using the resvg-js library.

Community
Intermediate
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced