memory-forensics

Overview of memory-forensics skill

What the memory-forensics skill does

The memory-forensics skill helps an agent work through RAM acquisition and memory dump analysis using established tooling such as Volatility 3 and common capture utilities. It is aimed at incident response, malware triage, and host investigation workflows where disk artifacts alone are not enough.

Who this skill is best for

This memory-forensics skill is a strong fit for:

• responders handling suspected compromise on Windows, Linux, or macOS
• analysts examining a captured memory image or VM memory file
• users who need a practical starting structure for process, network, and artifact analysis
• teams doing memory-forensics for Incident Triage rather than deep kernel research

It is less useful if you do not yet have a memory image, cannot legally or safely collect one, or only need basic log review.

The real job-to-be-done

Most users do not need a history lesson on memory analysis. They need help answering questions such as:

• what is the safest way to capture RAM on this system?
• how do I analyze the dump with the right tool and symbols?
• which processes, injected code, credentials, sockets, and persistence clues should I check first?
• how do I turn a broad suspicion into a repeatable memory-forensics guide?

This skill is valuable because it bundles those tasks into a usable workflow instead of leaving the agent to improvise from a blank prompt.

What differentiates this skill

The main differentiator is breadth across the full memory-forensics path: acquisition options, VM capture, Volatility setup, and investigative categories like processes, DLLs, networking, registry data, malware indicators, and extraction. It is more operational than a generic “analyze this dump” prompt, especially when you need the agent to suggest the next forensic step, not just name tools.

What to know before you install

This repository path contains a single SKILL.md with the guidance. There are no helper scripts, packaged symbols, automation rules, or sample datasets in the skill folder. That means the memory-forensics install is lightweight, but output quality depends heavily on the details you provide: operating system, capture method, file format, suspected threat, and the exact question you need answered.

How to Use memory-forensics skill

Install context for the memory-forensics skill

Install the skill from the repository, then invoke it when your task involves memory capture, Volatility-based analysis, or artifact extraction from RAM.

npx skills add https://github.com/wshobson/agents --skill memory-forensics

Because the skill folder only exposes SKILL.md, there is little hidden behavior. What you get is structured guidance, not a turnkey forensic pipeline.

Read this file first

Start with:

• plugins/reverse-engineering/skills/memory-forensics/SKILL.md

Since there are no companion scripts or references in the folder, reading SKILL.md is effectively the full repository-reading path for this skill.

What input the skill needs to work well

The memory-forensics skill performs best when you provide concrete forensic context. Include:

• target OS and version if known
• memory image path and format, such as .raw, .lime, .elf, or VM memory
• whether the image is from a live capture, hypervisor snapshot, or endpoint tool
• analysis goal: triage, malware confirmation, credential theft, injected code, suspicious network activity
• any known indicators: hostname, usernames, process names, hashes, IPs, domains, timestamps
• your available tools: vol, python, symbol packs, YARA rules, strings, grep

Without this, the agent will default to a generic memory-forensics usage plan instead of a targeted investigation.

Turn a rough goal into a good prompt

Weak prompt:

• “Analyze this memory dump.”

Stronger prompt:

• “Use the memory-forensics skill to triage a Windows 10 memory image at evidence/win10.raw. Prioritize suspicious processes, network connections, DLL injection, LSASS access, persistence clues, and files worth extracting. Assume I have Volatility 3 installed but not Windows symbols. Give me a step-by-step command sequence and explain what findings would be high priority for incident triage.”

The stronger version improves results because it gives the skill a platform, a file, an objective, and output expectations.

Example prompt for memory-forensics for Incident Triage

Use a prompt like this when speed matters:

Use the memory-forensics skill for Incident Triage on a Linux memory image captured with LiME. I need a prioritized workflow: identify suspicious processes, loaded modules, open sockets, shell history or credentials in memory if feasible, and anything that suggests rootkit or malware activity. Recommend Volatility 3 commands, note any plugin limitations, and tell me what to extract for follow-up.

This keeps the output practical and triage-oriented instead of drifting into broad theory.

Typical workflow the skill supports

A good usage pattern is:

1. Identify the source and format of the memory image.
2. Confirm the platform and choose the acquisition-specific handling.
3. Set up Volatility 3 and required symbols if applicable.
4. Run baseline enumeration on processes, command lines, network connections, modules, and handles.
5. Pivot into suspicious artifacts: injected code, credential material, registry data, browser traces, or malware unpacking clues.
6. Extract high-value artifacts for offline review.
7. Summarize findings with confidence levels and next steps.

The skill is most helpful when you ask for this as a decision-driven workflow, not just a list of plugins.

What the skill actually covers well

From the source content, this memory-forensics guide is strongest on:

• live acquisition options for Windows, Linux, and macOS
• virtual machine memory collection
• Volatility 3 installation and setup
• process and artifact analysis from dumps
• malware analysis and extraction tasks

That makes it especially useful if your blocker is choosing the next command or the next artifact category to inspect.

Practical install and environment notes

The skill references Volatility 3, so plan for:

• Python environment management
• symbol availability, especially on Windows
• adequate storage for large memory images
• permission-sensitive acquisition on live systems
• format differences between raw dumps, ELF-style captures, and hypervisor outputs

In practice, many failed first runs are environment problems rather than analysis problems. If you want the agent to help, tell it exactly what failed: install error, symbol issue, unsupported format, or plugin mismatch.

Tips that materially improve output quality

To get better memory-forensics usage from the agent:

• ask for command-by-command workflows, not just concepts
• ask it to separate “triage first” checks from “deep dive later” checks
• provide known suspicious process names or IPs so it can build pivots
• ask for expected outputs and how to interpret anomalies
• ask it to flag where Volatility 3 may need symbols or where a plugin may not fit your OS

These prompts reduce hand-wavy advice and force the skill into operational mode.

What this skill does not automate

This is not a packaged forensic suite. The memory-forensics skill does not ship:

• acquisition binaries
• curated symbol bundles
• validation scripts
• chain-of-custody tooling
• one-click report generation

If you need end-to-end automation, treat this skill as analysis guidance and command scaffolding, not as a replacement for your forensic toolkit.

memory-forensics skill FAQ

Is this memory-forensics skill good for beginners?

Yes, if you already understand basic command-line usage and what a memory image is. The skill gives enough structure to start, but it does not eliminate the need to know your platform, tool availability, and investigative goal. Absolute beginners may still need external help for Volatility installation and symbol handling.

When is the memory-forensics skill a better choice than a normal prompt?

Use the memory-forensics skill when you want the agent to stay inside a forensic workflow: acquisition, triage, artifact extraction, and malware-oriented pivots. A generic prompt may produce vague advice, while this skill is more likely to suggest realistic tools, commands, and investigative order.

Does the memory-forensics install include tools like Volatility?

No. The memory-forensics install adds the skill guidance, not the forensic binaries. You still need to install and validate tools such as volatility3 yourself.

Can I use it for live memory acquisition guidance?

Yes. The source content explicitly includes live acquisition approaches for Windows, Linux, and macOS, plus virtual machine memory capture. That said, you should still validate operational risk before collecting RAM on production or potentially unstable hosts.

Is it suitable for malware analysis?

Yes. The skill is a good fit when malware may only be visible in memory through injected code, unpacked payloads, suspicious modules, or live process artifacts. It is especially useful when disk-based scans are incomplete.

When should I not use this skill?

Skip this memory-forensics guide if:

• you do not have a memory image and cannot capture one
• your task is purely disk forensics or SIEM review
• you need courtroom-grade procedure documentation more than analytic guidance
• you expect automated parsing without tool setup or operator input

Does it fit only Windows analysis?

No. The skill covers Windows, Linux, macOS, and VM memory capture paths. Still, practical depth is usually highest where your tools and symbols are strongest, so tell the agent your target platform early.

How to Improve memory-forensics skill

Give the agent better forensic context

The fastest way to improve memory-forensics output is to provide stronger evidence up front. Include:

• exact filename and format
• capture source
• OS family
• suspected behavior
• known IOCs
• what you already tried

This helps the agent choose the right plugins, sequence, and pivots instead of generating a generic checklist.

Ask for prioritized, not exhaustive, analysis

A common failure mode is getting a huge list of possible checks with no triage order. Ask the memory-forensics skill to rank steps as:

• immediate triage
• high-value follow-up
• optional deep analysis

That format is much more useful during incident response.

Force command output interpretation

Do not only ask for commands. Ask what suspicious output would look like. For example:

• unusual parent-child process chains
• hidden or terminated-but-resident processes
• anomalous network listeners
• evidence of LSASS access
• unsigned or oddly placed modules

Interpretation guidance is where this skill adds more value than raw command lists.

Improve prompts with scope boundaries

Good prompts define constraints such as:

• “Windows only”
• “Volatility 3 only”
• “No internet access for symbol downloads”
• “Need findings in under 30 minutes”
• “Focus on credential theft and C2”

These constraints make memory-forensics recommendations more realistic and easier to execute.

Iterate after the first output

After the first response, feed the agent real findings:

• suspicious PIDs
• module names
• IP addresses
• process command lines
• extracted filenames
• plugin errors

Then ask for the next pivots. The memory-forensics skill becomes much more useful once it can narrow from broad triage into evidence-driven follow-up.

Watch for common failure modes

Typical issues include:

• wrong assumptions about OS profile or symbols
• recommending acquisition steps after a dump already exists
• over-prioritizing exhaustive enumeration over triage
• giving plugins without explaining why they matter
• ignoring file format or hypervisor context

You can reduce these by stating your current stage clearly: acquisition, setup, baseline triage, malware hunt, or extraction.

Use the skill as a workflow template

One of the best ways to improve this memory-forensics guide in practice is to reuse its structure across cases. Ask the agent to turn the skill into:

• a triage checklist
• a case-specific runbook
• a reusable prompt template for your team
• a command plan with placeholders for image path, host, and IOC set

That turns a one-time answer into a repeatable incident response asset.