memory-forensics

name	memory-forensics
description	Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
version	1.1.0
model	sonnet
invoked_by	["reverse-engineer","security-architect","incident-responder"]
tools	["Read","Write","Edit","Bash","Glob","Grep"]
verified	true
lastVerifiedAt	"2026-02-22T00:00:00.000Z"
source	builtin
trust_score	100
provenance_sha	7f3ede585d3c577a

Memory Forensics

Security Notice

AUTHORIZED USE ONLY: These skills are for DEFENSIVE security analysis and authorized research:

• Incident response with proper authorization
• Forensic investigations in authorized contexts
• Malware analysis for defensive purposes
• CTF competitions and security research
• Educational purposes in controlled environments

NEVER use for:

• Unauthorized system access or surveillance
• Privacy violations
• Intellectual property theft
• Any illegal activities

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

Memory Acquisition

Live Acquisition Tools

Windows

# WinPmem (Recommended)
winpmem_mini_x64.exe memory.raw

# DumpIt
DumpIt.exe

# Belkasoft RAM Capturer
# GUI-based, outputs raw format

# Magnet RAM Capture
# GUI-based, outputs raw format

Linux

# LiME (Linux Memory Extractor)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF format)
sudo cp /proc/kcore memory.elf

macOS

# osxpmem
sudo ./osxpmem -o memory.raw

# MacQuisition (commercial)

Virtual Machine Memory

# VMware: .vmem file is raw memory
cp vm.vmem memory.raw

# VirtualBox: Use debug console
vboxmanage debugvm "VMName" dumpvmcore --filename memory.elf

# QEMU
virsh dump <domain> memory.raw --memory-only

# Hyper-V