# Memory Forensics

> Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.

- Skill: `dokhacgiakhoa/memory-forensics` (Agent Skill, multi-file: 21 files)
- Install (CLI): `npx skillmds@latest add dokhacgiakhoa/memory-forensics`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dokhacgiakhoa/memory-forensics/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: Dokhacgiakhoa (https://skillmd.com/u/dokhacgiakhoa)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/dokhacgiakhoa/memory-forensics

---


# Memory Forensics

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

## Use this skill when

- Working on memory forensics tasks or workflows
- Needing guidance, best practices, or checklists for memory forensics

## Do not use this skill when

- The task is unrelated to memory forensics
- You need a different domain or tool outside this scope

## Instructions

- Clarify goals, constraints, and required inputs.
- Apply relevant best practices and validate outcomes.
- Provide actionable steps and verification.
- If detailed examples are required, open `resources/implementation-playbook.md`.

## Memory Acquisition

## 🧠 Knowledge Modules (Fractal Skills)

### 1. [Live Acquisition Tools](./sub-skills/live-acquisition-tools.md)
### 2. [Virtual Machine Memory](./sub-skills/virtual-machine-memory.md)
### 3. [Installation and Setup](./sub-skills/installation-and-setup.md)
### 4. [Essential Plugins](./sub-skills/essential-plugins.md)
### 5. [Linux Analysis](./sub-skills/linux-analysis.md)
### 6. [macOS Analysis](./sub-skills/macos-analysis.md)
### 7. [Malware Analysis Workflow](./sub-skills/malware-analysis-workflow.md)
### 8. [Incident Response Workflow](./sub-skills/incident-response-workflow.md)
### 9. [Windows Process Structures](./sub-skills/windows-process-structures.md)
### 10. [VAD (Virtual Address Descriptor)](./sub-skills/vad-virtual-address-descriptor.md)
### 11. [Process Injection Indicators](./sub-skills/process-injection-indicators.md)
### 12. [Rootkit Detection](./sub-skills/rootkit-detection.md)
### 13. [Credential Extraction](./sub-skills/credential-extraction.md)
### 14. [Writing Memory YARA Rules](./sub-skills/writing-memory-yara-rules.md)
### 15. [Scanning Memory](./sub-skills/scanning-memory.md)
### 16. [Extracting Strings](./sub-skills/extracting-strings.md)
### 17. [FLOSS for Obfuscated Strings](./sub-skills/floss-for-obfuscated-strings.md)
### 18. [Acquisition Best Practices](./sub-skills/acquisition-best-practices.md)
### 19. [Analysis Best Practices](./sub-skills/analysis-best-practices.md)
### 20. [Common Pitfalls](./sub-skills/common-pitfalls.md)