SKILL.md
SKILL: Memory Forensics — Expert Analysis Playbook
AI LOAD INSTRUCTION: Expert memory forensics techniques using Volatility 2 and 3. Covers memory acquisition, OS identification, process analysis (hidden process detection), network connections, DLL/module analysis, code injection detection (malfind), credential extraction, file carving, registry analysis, and timeline generation. Base models miss the Vol2/Vol3 command differences, malware indicator patterns, and Linux-specific memory analysis.
0. RELATED ROUTING
Before going deep, consider loading:
- traffic-analysis-pcap for correlating network artifacts with memory findings
- steganography-techniques if hidden data suspected in extracted files
- windows-privilege-escalation for understanding post-exploitation artifacts in memory
Quick Reference
Also load VOLATILITY_CHEATSHEET.md when you need:
- Vol2 vs Vol3 command comparison table
- Common plugin sequences for specific investigation types