memory-forensics
Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
Security Assessment
Detected risks:
About memory-forensics
The 'memory-forensics' skill provides advanced techniques for acquiring, analyzing, and extracting artifacts from memory dumps, which is crucial for incident response and malware analysis. It addresses the challenges of investigating memory dumps captured from different environments, such as Windows, Linux, macOS, and virtual machines. The skill enables forensic experts to extract vital information from volatile memory, which is often the most immediate source of data following a cyberattack or system breach. This skill focuses on the use of tools like Volatility and its related plugins to offer in-depth memory analysis across multiple platforms.
FAQ
What tools can I use for live memory acquisition?
For live memory acquisition on Windows, tools like WinPmem, DumpIt, and Belkasoft RAM Capturer are recommended. On Linux, LiME and /dev/mem are popular choices, while macOS supports tools like osxpmem and MacQuisition.
Is the 'memory-forensics' skill compatible with virtual machines?
Yes, the skill supports memory acquisition from virtual machines. For VMware, the .vmem file can be directly used. For VirtualBox, QEMU, and Hyper-V, respective commands for dumping memory from virtual machines are available.
Do I need additional setup for using Volatility 3?
Yes, to use Volatility 3, you need to install it via pip and download the necessary symbol tables for your operating system. For Windows, symbol tables can be fetched from the Volatility Foundation's website.
Can I analyze Linux memory dumps with this skill?
Absolutely. This skill includes support for analyzing Linux memory dumps with tools such as linux.pslist for process listings, linux.pstree for process trees, and linux.sockstat for network connections.
Are there any system requirements for using these tools?
The tools mentioned in the skill, such as Volatility 3 and memory acquisition utilities, generally require root or administrator privileges to access raw memory. They also need specific dependencies like Python and system-specific drivers for memory extraction.
Install memory-forensics
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
wshobson/agents