memory-forensics - Perform memory acquisition and forensic analysis
Acquires, analyzes, and extracts digital artifacts from memory dumps for incident response and malware analysis.
Tags
Updated: 2026-09-24Capabilities
Typical Inputs
What this skill does
- Acquire live system memory
- Analyze process lists and trees
- Detect code injection mechanisms
- Inspect network connections and sockets
- Scan memory with YARA rules
- Extract credentials and password hashes
- Dump process memory and files
- Analyze Virtual Address Descriptors
Inputs
- Memory dump files
- Volatility symbol tables
- YARA rule files
- Target process IDs
Outputs
- Process tree text reports
- Network connection reports
- Dumped executable files
- Extracted string text files
- Timeline CSV files
- Extracted credential hashes
Requirements
- Python environment
- Volatility 3 framework
- Administrator or root privileges
- Memory acquisition tools