memory-forensics-volatility

What problem does it solve?

Provides a structured, expert playbook for analyzing volatile memory images to detect malware, recover credentials, investigate suspicious processes, and reconstruct incident timelines using Volatility 2 and 3.

Core Features & Use Cases

• Acquisition Guidance: Best practices for acquiring Windows, Linux, and VM memory images safely and reliably.
• Volatility 2 vs 3 Mapping: Clear command comparisons and plugin equivalences to run the correct analysis across Volatility versions.
• Process and Injection Analysis: Techniques to discover hidden processes (DKOM), reflective DLLs, RWX shellcode regions, and dumped injected sections.
• Network, File, and Registry Correlation: Correlate netscan output with processes, extract files from memory, and inspect registry hives for persistence and user activity.
• Credential Recovery & Timeline Generation: Steps for SAM/LSA extraction, cached credentials, and producing a mactime-style timeline for incident reconstruction.
• Linux Rootkit and Forensics: Linux-specific checks for syscall hooking, TTY/AF info anomalies, and shell history extraction for rootkit detection.
• Use Case: Rapidly triage a suspected compromise by identifying a malicious process, extracting its payload and network indicators, recovering any in-memory credentials, and producing a timeline for reporting.

Quick Start

Use the memory-forensics-volatility skill to analyze mem.raw, identify hidden processes and injected code, extract suspicious files and credentials, and produce an incident timeline.