memory-forensics
Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
Profile →npx skills add wshobson/agents --skill memory-forensics --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Memory Forensics Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis. ## When to Use This Skill - Performing memory analysis during incident response or breach investigation - Extracting malware artifacts (processes, injected code, network connections) from a RAM capture - Acquiring volatile memory from a live Windows/Linux/macOS system before shutdown - Using Volatility 3 / Rekall to triage memory dumps - Recovering credentials, browser sessions, or open files from process memory ## Memory Acquisition ### Live Acquisition Tools #### Windows ```powershell # WinPmem (Recommended) winpmem_mini_x64.exe memory.raw # DumpIt DumpIt.exe # Belkasoft RAM Capturer # GUI-based, outputs raw format # Magnet RAM Capture # GUI-based, outputs raw format ``` #### Linux ```bash # LiME (Linux Memory Extractor) sudo insmod lime.ko "path=/tmp/memory.lime format=lime" # /dev/mem (limited, requires permissions) sudo dd if=/dev/mem of=memory.raw bs=1M # /proc/kcore (ELF format) sudo cp /proc/kcore memory.elf ``` #### macOS ```bash # osxpmem sudo ./osxpmem -o memory.raw # MacQuisition (commercial) ``` ### Virtual Machine
- When to Use This Skill
- Memory Acquisition
- Live Acquisition Tools
- Virtual Machine Memory
- Detailed section: Volatility 3 Framework
- Analysis Workflows
- Malware Analysis Workflow
- Incident Response Workflow
- Data Structures
- Windows Process Structures
- VAD (Virtual Address Descriptor)
- Detection Patterns
- Process Injection Indicators
- Rootkit Detection
LiME (Linux Memory Extractor) sudo insmod lime.ko "path=/tmp/memory.lime format=lime" sudo dd if=/dev/mem of=memory.raw bs=1M sudo cp /proc/kcore memory.elf osxpmem sudo ./osxpmem -o memory.raw MacQuisition (commercial) cp vm.vmem memory.raw vboxmanage debugvm "VMName" dumpvmcore --filename memory.elf QEMU
What does the memory-forensics skill do?
Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
How do I install it?
Run `npx skills add wshobson/agents --skill memory-forensics --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From wshobson/agents, a repository with 38,479 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.