Memory Forensics Volatility

This is a complete memory forensics reference that covers both Volatility 2 and 3 command syntax, which matters because the tools handle profiles and plugins completely differently. The playbook walks through the full analysis chain: OS identification, hidden process detection via psscan vs pslist comparison, code injection hunting with malfind, credential extraction, and timeline reconstruction. It includes Linux-specific analysis and rootkit detection techniques that base models consistently miss. The malware indicators table is especially useful, like catching DKOM hiding when processes appear in pool scans but not the EPROCESS list, or spotting reflective DLL injection through ldrmodules output. Load this when you're doing incident response or malware analysis and need the exact command differences between Vol2 and Vol3 without constantly checking documentation.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill memory-forensics-volatility --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Memory Forensics — Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert memory forensics techniques using Volatility 2 and 3. Covers memory acquisition, OS identification, process analysis (hidden process detection), network connections, DLL/module analysis, code injection detection (malfind), credential extraction, file carving, registry analysis, and timeline generation. Base models miss the Vol2/Vol3 command differences, malware indicator patterns, and Linux-specific memory analysis.

0. RELATED ROUTING

Before going deep, consider loading:

traffic-analysis-pcap for correlating network artifacts with memory findings
steganography-techniques if hidden data suspected in extracted files
windows-privilege-escalation for understanding post-exploitation artifacts in memory