memory-forensics - Memory Forensics Analysis and Artifact Extraction
Acquire and analyze memory dumps using Volatility and other tools for incident response and malware analysis.
Tags
Updated: 2026-09-23Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Acquire live memory dumps
- Analyze processes and process trees
- Detect memory code injection
- Scan memory with YARA rules
- Dump process memory and files
- Inspect memory network connections
Inputs
- Memory dump files
- YARA rule files
- Volatility symbol tables
Outputs
- Dumped executable files
- Extracted text strings
- Timeline CSV reports
- Forensic analysis text logs
Requirements
- Volatility 3 framework
- Root or administrator privileges
- Memory acquisition tools