memory-forensics

Acquire and analyze memory dumps with Volatility 3.

38.6k|4.1k|Updated Jul 24, 2025

Search Tags:#incident response #volatility #malware analysis #memory forensics #digital forensics #artifact extraction

Ready to run

npx skills add https://github.com/wshobson/agents --skill memory-forensics-wshobson

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: memory-forensics
Source: https://github.com/wshobson/agents/tree/main/plugins/reverse-engineering/skills/memory-forensics
Command: npx skills add https://github.com/wshobson/agents --skill memory-forensics-wshobson

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill empowers users to conduct in-depth memory forensics, enabling the acquisition, analysis, and extraction of critical artifacts from memory dumps for incident response and malware analysis.

Core Features & Use Cases

Memory Acquisition: Provides commands for live and virtual machine memory acquisition across Windows, Linux, and macOS.
Volatility 3 Analysis: Offers comprehensive guidance on using Volatility 3 for process analysis, network forensics, malware detection, and artifact extraction.
Use Case: When investigating a suspected system compromise, use this Skill to acquire a memory dump and then analyze it with Volatility 3 to identify malicious processes, network connections, and hidden artifacts that may not be visible through traditional disk-based analysis.

Quick Start

Acquire live memory from a Windows system using WinPmem and save it as memory.raw.

Frequently Asked Questions about memory-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I acquire a memory dump from a live Windows system for incident response?▼

Memory acquisition from a live Windows system uses WinPmem to capture RAM and save it as a memory.raw file. This dump provides the input needed for Volatility 3 analysis to identify malicious processes and hidden artifacts during incident response.

What is the best way to analyze a memory dump for malware detection?▼

Memory dump analysis for malware detection uses the Volatility 3 framework to inspect processes, network connections, and hidden artifacts. This approach reveals malicious activity residing entirely in RAM that traditional disk-based analysis cannot detect.

Does Volatility 3 work for memory forensics across different operating systems?▼

Volatility 3 supports memory forensics across Windows, Linux, and macOS. The Skill provides acquisition commands for multiple operating systems using tools like WinPmem and LiME to capture RAM before detailed process and network analysis.

How do I extract hidden artifacts from RAM during a digital forensics investigation?▼

Hidden artifact extraction from RAM uses Volatility 3 to analyze memory captures for malicious processes, network connections, and system artifacts. This digital forensics technique uncovers threats invisible to standard disk inspections.

Can I use YARA rules to scan a memory dump for threats?▼

YARA scans memory dumps to identify specific threat indicators and malware signatures within RAM captures. This deep system inspection works alongside Volatility 3 analysis for comprehensive threat identification during incident response.

When should I use memory forensics instead of traditional disk-based analysis?▼

Memory forensics is necessary when investigating system compromises that leave no disk traces, such as fileless malware or in-memory network connections. It captures volatile data and hidden artifacts that traditional disk-based analysis cannot recover.