A comprehensive framework for acquiring and analyzing volatile memory to detect malware, rootkits, and unauthorized system activity.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install s3-memory-forensics
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install s3-memory-forensics using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Memory Forensics?
Memory Forensics provides an essential toolkit for investigators to capture and examine the contents of a system's RAM. Unlike disk forensics, this discipline focuses on volatile data that disappears when a machine is powered off, making it critical for identifying active malware, hidden processes, and transient network connections. By leveraging industry-standard tools like Volatility 3 and LiME, users can uncover sophisticated threats that leave no trace on the physical hard drive.
This skill within the Openclaw Skills ecosystem guides developers and security researchers through the complexities of different operating systems including Windows, Linux, and macOS. It bridges the gap between raw data acquisition and actionable intelligence, offering structured methodologies for incident response and deep-dive forensic audits.
Memory Forensics Use Cases
- Investigating active security breaches and suspicious system behavior.
- Analyzing sophisticated malware that employs process hollowing or injection.
- Recovering ephemeral data such as unsaved documents, command-line history, and encryption keys.
- Detecting advanced rootkits that manipulate kernel objects to hide from standard OS tools.
- Performing forensic audits on virtual machines and cloud instances.
How Memory Forensics Works
- Memory Acquisition: Use specialized tools like WinPmem, LiME, or osxpmem to capture a bit-for-bit image of the physical RAM.
- Environment Setup: Configure the Volatility 3 framework and download the necessary symbol tables specific to the target OS version.
- Initial Survey: Run high-level plugins to generate process trees and network connection lists to identify obvious anomalies.
- Deep Analysis: Execute targeted plugins to scan for injected code (malfind), suspicious DLLs, and registry persistence mechanisms.
- Artifact Extraction: Dump suspicious executables, files, or memory regions for further string analysis or YARA scanning.
- Correlation: Cross-reference findings with filesystem artifacts and network logs to build a comprehensive incident timeline.
Memory Forensics Setup
To begin using this skill with Openclaw Skills, install the Volatility 3 framework and the necessary acquisition tools:
# Install the Volatility 3 framework
pip install volatility3
# For Linux memory acquisition (LiME)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
# Basic Volatility usage example
vol -f memory.raw windows.pslist
Memory Forensics Data Schema & Taxonomy
The skill organizes forensic data into structured outputs to facilitate rapid review. Key data structures include:
| Data Type | Description | Relevant Metadata |
|---|---|---|
| EPROCESS | Windows Kernel Process Block | PID, CreateTime, ImageFileName, PEB Pointer |
| PEB | Process Environment Block | ImageBaseAddress, DLL list (Ldr), Parameters |
| VAD | Virtual Address Descriptor | Memory protection flags (PAGE_EXECUTE), FileObjects |
| Registry Hives | Volatile Hive Data | Key paths, values, and LastWrite times |
Memory Forensics Advanced Features
- Multi-OS support covering detailed plugin sets for Windows, Linux, and macOS analysis.
- Integrated YARA scanning for automated detection of known malware signatures within RAM dumps.
- Advanced rootkit detection via DKOM analysis and SSDT (System Service Descriptor Table) hooking checks.
- Automated credential extraction including SAM hashes, LSA secrets, and cached domain credentials.
- Specialized workflows for VM memory analysis targeting VMware (.vmem), VirtualBox, and QEMU environments.
SKILL.md
Loading
Related Openclaw Skills
Corespeed NanoBanana: Gemini Image & Text Generation
A high-performance Gemini-powered tool for multi-modal image generation, editing, and text analysis via the Corespeed AI Gateway.
SharePlay Developer
A comprehensive developer toolkit for building, integrating, and troubleshooting SharePlay GroupActivities features across Apple platforms including visionOS.
MoltbotDen Media Studio
A high-performance REST API for generating professional-grade AI images and videos using Imagen 4 and Veo 3.1.
Brainstorming
A mandatory collaborative protocol that transforms vague ideas into rigorous technical designs before a single line of code is written.
Responsive Tester
A local, zero-dependency reference tool providing instant access to responsive design patterns and DevTools best practices.
Secret Encrypt Reference
An offline-first reference tool for developers to quickly look up Secret Encrypt concepts, security patterns, and implementation best practices.
Featured*
