memory-forensics
memory forensics
What it does
- Performing memory analysis during incident response or breach investigation
- Extracting malware artifacts (processes, injected code, network connections) from a RAM capture
- Acquiring volatile memory from a live Windows/Linux/macOS system before shutdown
- Using Volatility 3 / Rekall to triage memory dumps
- Recovering credentials, browser sessions, or open files from process memory
- Stale data: Memory is volatile, analyze promptly
- Incomplete dumps: Verify dump size matches expected RAM
Requirements & configuration
- /dev/mem (limited, requires permissions)
- Dump hashes (requires hivelist first)
- Requires specific plugins/tools
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
memory-forensics FAQ
What does the memory-forensics skill do?
Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures. Performing memory analysis during incident response or breach investigation Extracting malware artifacts (processes, injected code, network connections) from a RAM capture
What does memory-forensics require?
/dev/mem (limited, requires permissions) Dump hashes (requires hivelist first) Requires specific plugins/tools
How do I install memory-forensics?
Run: npx -y skills add https://github.com/wshobson/agents --skill memory-forensics --agent claude-code — the source lives at github.com/wshobson/agents.
Maintain memory-forensics?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/wshobson-agents-memory-forensics?ref=badge) npx agentictools info skills/wshobson-agents-memory-forensics The second line is the CLI lookup for this page — handy in READMEs and docs.
