Agent-Skills.md

Agent Skills: Analyzing Memory Forensics with LiME and Volatility

>

UncategorizedID: autohandai/community-skills/analyzing-memory-forensics-with-lime-and-volatility

Repository

autohandai/community-skills
autohandaiLicense: Apache-2.0
103

Install this agent skill to your local

pnpm dlx add-skill https://github.com/autohandai/community-skills/tree/HEAD/analyzing-memory-forensics-with-lime-and-volatility

Skill Files

Browse the full folder contents for analyzing-memory-forensics-with-lime-and-volatility.

Download Skill

Loading file tree…

analyzing-memory-forensics-with-lime-and-volatility/SKILL.md

Skill Metadata

Name
analyzing-memory-forensics-with-lime-and-volatility
Description
>

Analyzing Memory Forensics with LiME and Volatility

Instructions

Acquire Linux memory using LiME kernel module, then analyze with Volatility 3 to extract forensic artifacts from the memory image.

# LiME acquisition
insmod lime-$(uname -r).ko "path=/evidence/memory.lime format=lime"

# Volatility 3 analysis
vol3 -f /evidence/memory.lime linux.pslist
vol3 -f /evidence/memory.lime linux.bash
vol3 -f /evidence/memory.lime linux.sockstat

import volatility3
from volatility3.framework import contexts, automagic
from volatility3.plugins.linux import pslist, bash, sockstat

# Programmatic Volatility 3 usage
context = contexts.Context()
automagics = automagic.available(context)

Key analysis steps:

  1. Acquire memory with LiME (format=lime or format=raw)
  2. List processes with linux.pslist, compare with linux.psscan
  3. Extract bash command history with linux.bash
  4. List network connections with linux.sockstat
  5. Check loaded kernel modules with linux.lsmod for rootkits

Examples

# Full forensic workflow
vol3 -f memory.lime linux.pslist | grep -v "\[kthread\]"
vol3 -f memory.lime linux.bash
vol3 -f memory.lime linux.malfind
vol3 -f memory.lime linux.lsmod