memory-forensics
Acquire, analyze, and extract artifacts from memory dumps for incident response and malware analysis.
- Supports live memory acquisition across Windows (WinPmem, DumpIt), Linux (LiME, /dev/mem), and macOS (osxpmem), plus virtual machine memory from VMware, VirtualBox, QEMU, and Hyper-V
- Volatility 3 framework with 30+ plugins covering process analysis, network connections, DLL inspection, code injection detection, registry analysis, and file system artifacts
- Includes malware analysis and incident response workflows with process tree visualization, hidden process detection, persistence mechanism discovery, and YARA integration for pattern matching
- Detects injection techniques, rootkits, and credential artifacts; supports string extraction and cross-referencing across multiple data sources for timeline correlation
Memory Forensics
Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.
Memory Acquisition
Live Acquisition Tools
Windows
# WinPmem (Recommended)
winpmem_mini_x64.exe memory.raw
# DumpIt
DumpIt.exe
# Belkasoft RAM Capturer
# GUI-based, outputs raw format
More from wshobson/agents
tailwind-design-system
Build scalable design systems with Tailwind CSS v4, design tokens, component libraries, and responsive patterns. Use when creating component libraries, implementing design systems, or standardizing UI patterns.
41.0Ktypescript-advanced-types
Master TypeScript's advanced type system including generics, conditional types, mapped types, template literals, and utility types for building type-safe applications. Use when implementing complex type logic, creating reusable type utilities, or ensuring compile-time type safety in TypeScript projects.
40.4Knodejs-backend-patterns
Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices architectures.
31.8Kpython-performance-optimization
Profile and optimize Python code using cProfile, memory profilers, and performance best practices. Use when debugging slow Python code, optimizing bottlenecks, or improving application performance.
22.1Kapi-design-principles
Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewing API specifications, or establishing API design standards.
20.3Kpython-testing-patterns
Implement comprehensive testing strategies with pytest, fixtures, mocking, and test-driven development. Use when writing Python tests, setting up test suites, or implementing testing best practices.
19.7K