Memory Forensics

This is a solid reference for anyone doing incident response or malware analysis with memory dumps. It covers acquisition across Windows, Linux, and macOS, then dives deep into Volatility 3 with practical command examples for process analysis, injection detection, network artifacts, and registry examination. The workflow sections are especially helpful, they walk you through actual investigation sequences rather than just listing plugins. It includes some low-level data structure details for Windows internals like EPROCESS and VAD trees, which is useful if you're trying to understand what Volatility is actually parsing. If you're triaging a compromised system or reverse engineering malware behavior from RAM, this gives you the command sequences and detection patterns you need without having to dig through documentation.

skills.sh installs: 196
GitHub stars: 39.4K
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add sickn33/antigravity-awesome-skills --skill memory-forensics --agent claude-code

Installs into .claude/skills of the current project.

Files

Memory Forensics

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

Use this skill when

Working on memory forensics tasks or workflows
Needing guidance, best practices, or checklists for memory forensics

Do not use this skill when

The task is unrelated to memory forensics
You need a different domain or tool outside this scope

Instructions

Clarify goals, constraints, and required inputs.
Apply relevant best practices and validate outcomes.
Provide actionable steps and verification.

Memory Acquisition

Confirm authorization for the exact host/VM and sensitive-memory acquisition before collection. Dumps can contain passwords, private keys and personal records: store encrypted/restricted, hash originals, record tool/version/time and chain of custody, and analyze copies offline. Do not upload dumps or credential outputs to external services without explicit disclosure authority. Credential-extraction plugins are a separate sensitive step, not routine triage.

SKILL.md on GitHub