Prompt
Check a dataset before analysis
Find missing values, inconsistent formats, duplicates, and questions that could invalidate results.
ClaudeChatGPTGeminiData & Analytics
Dave AI
Memory Forensics
Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
instructions.md
--- version: 4.1.0-fractal name: memory-forensics-ca57dbd9f41f description: Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures. --- # Memory Forensics Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis. ## Use this skill when - Working on memory forensics tasks or workflows - Needing guidance, best practices, or checklists for memory forensics ## Do not use this skill when - The task is unrelated to memory forensics - You need a different domain or tool outside this scope ## Instructions - Clarify goals, constraints, and required inputs. - Apply relevant best practices and validate outcomes. - Provide actionable steps and verification. - If detailed examples are required, open `resources/implementation-playbook.md`. ## Memory Acquisition ## 🧠 Knowledge Modules (Fractal Skills) ### 1. [Live Acquisition Tools](./sub-skills/live-acquisition-tools.md) ### 2. [Virtual Machine Memory](./sub-skills/virtual-machine-memory.md) ### 3. [Installation and Setup](./sub-skills/installation-and-setup.md) ### 4. [Essential Plugins](./sub-skills/essential-plugins.md) ### 5. [Linux Analysis](./sub-skills/linux-analysis.md) ### 6. [macOS Analysis](./sub-skills/macos-analysis.md) ### 7. [Malware Analysis Workflow](./sub-skills/malware-analysis-workflow.md) ### 8. [Incident Response Workflow](./sub-skills/incident-response-workflow.md) ### 9. [Windows Process Structures](./sub-skills/windows-process-structures.md) ### 10. [VAD (Virtual Address Descriptor)](./sub-skills/vad-virtual-address-descriptor.md) ### 11. [Process Injection Indicators](./sub-skills/process-injection-indicators.md) ### 12. [Rootkit Detection](./sub-skills/rootkit-detection.md) ### 13. [Credential Extraction](./sub-skills/credential-extraction.md) ### 14. [Writing Memory YARA Rules](./sub-skills/writing-memory-yara-rules.md) ### 15. [Scanning Memory](./sub-skills/scanning-memory.md) ### 16. [Extracting Strings](./sub-skills/extracting-strings.md) ### 17. [FLOSS for Obfuscated Strings](./sub-skills/floss-for-obfuscated-strings.md) ### 18. [Acquisition Best Practices](./sub-skills/acquisition-best-practices.md) ### 19. [Analysis Best Practices](./sub-skills/analysis-best-practices.md) ### 20. [Common Pitfalls](./sub-skills/common-pitfalls.md)--- version: 4.1.0-fractal name: memory-forensics-ca57dbd9f41f description: Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures. --- # Memory Forensics Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis. ## Use this skill when - Working on memory forensics tasks or workflows - Needing guidance, best practices, or checklists for memory forensics ## Do not use this skill when - The task is unrelated to memory forensics - You need a different domain or tool outside this scope ## Instructions - Clarify goals, constraints, and required inputs. - Apply relevant best practices and validate outcomes. - Provide actionable steps and verification. - If detailed examples are required, open `resources/implementation-playbook.md`. ## Memory Acquisition ## 🧠 Knowledge Modules (Fractal Skills) ### 1. [Live Acquisition Tools](./sub-skills/live-acquisition-tools.md) ### 2. [Virtual Machine Memory](./sub-skills/virtual-machine-memory.md) ### 3. [Installation and Setup](./sub-skills/installation-and-setup.md) ### 4. [Essential Plugins](./sub-skills/essential-plugins.md) ### 5. [Linux Analysis](./sub-skills/linux-analysis.md) ### 6. [macOS Analysis](./sub-skills/macos-analysis.md) ### 7. [Malware Analysis Workflow](./sub-skills/malware-analysis-workflow.md) ### 8. [Incident Response Workflow](./sub-skills/incident-response-workflow.md) ### 9. [Windows Process Structures](./sub-skills/windows-process-structures.md) ### 10. [VAD (Virtual Address Descriptor)](./sub-skills/vad-virtual-address-descriptor.md) ### 11. [Process Injection Indicators](./sub-skills/process-injection-indicators.md) ### 12. [Rootkit Detection](./sub-skills/rootkit-detection.md) ### 13. [Credential Extraction](./sub-skills/credential-extraction.md) ### 14. [Writing Memory YARA Rules](./sub-skills/writing-memory-yara-rules.md) ### 15. [Scanning Memory](./sub-skills/scanning-memory.md) ### 16. [Extracting Strings](./sub-skills/extracting-strings.md) ### 17. [FLOSS for Obfuscated Strings](./sub-skills/floss-for-obfuscated-strings.md) ### 18. [Acquisition Best Practices](./sub-skills/acquisition-best-practices.md) ### 19. [Analysis Best Practices](./sub-skills/analysis-best-practices.md) ### 20. [Common Pitfalls](./sub-skills/common-pitfalls.md)
Platform guidance
Imported from the listed AgentSkill.sh category. Complete supplied package files and notices are retained. Required external tools and credentials are not installed. No bundled code was executed during import. Individual agent task behavior has not been tested.