memprocfs-assistant
Assists with memory analysis and forensics using MemProcFS. Use when analyzing memory dumps, investigating system activity, or performing forensic examinations.
When & Why to Use This Skill
The MemProcFS Assistant is a specialized Claude skill designed for advanced memory analysis and digital forensics. It leverages the MemProcFS framework to help security professionals and forensic investigators analyze memory dumps, perform live system triage, and automate forensic workflows through Python API integration, significantly accelerating the detection of malicious activity.
Use Cases
- Malware Investigation: Identifying malicious processes, hidden modules, and suspicious network connections within a memory dump to understand infection vectors.
- Incident Response: Rapidly triaging live system memory to detect signs of compromise, unauthorized access, or active threats during a security breach.
- Forensic Examination: Conducting deep-dive analysis of system artifacts and memory structures to reconstruct timelines and gather digital evidence for legal or internal investigations.
- Automated Forensic Workflows: Generating custom Python scripts using the MemProcFS API to automate repetitive memory forensics tasks and large-scale data extraction.
| name | memprocfs-assistant |
|---|---|
| description | Assists with memory analysis and forensics using MemProcFS. Use when analyzing memory dumps, investigating system activity, or performing forensic examinations. |
MemProcFS Assistant
This Skill enhances my ability to perform memory analysis and forensics using MemProcFS. When you ask for help with a memory dump, live memory analysis, or a forensic investigation, I will use this Skill to guide my actions.
Core Capabilities
- Initial Triage: I will start by performing an initial triage of the memory image to identify key system information, running processes, and network connections.
- Guided Analysis: I will guide you through the analysis process, suggesting relevant MemProcFS modules and commands based on your goals.
- Forensic Workflows: For common forensic tasks, I will follow structured workflows to ensure a thorough investigation. Refer to forensic-workflows.md for detailed procedures.
- Python API Integration: I can generate Python scripts using the MemProcFS API for automated analysis. See python-api-guide.md for a complete guide.
Additional Resources
- For a complete reference of the MemProcFS virtual file system, see filesystem-reference.md.
- For practical examples and use cases, refer to examples.md.
- If you encounter any issues, please consult the troubleshooting.md guide.
Getting Started
To begin, please provide me with the path to your memory dump file or specify the live memory acquisition method (e.g., pmem, fpga). For example:
"Analyze the memory dump at
/mnt/dumps/suspicious.dmp"
"Start a live analysis on this machine using pmem."