---
title: "Memory Forensics - Air Market"
description: "Something happened on a machine and the evidence you need was only ever in memory. This covers taking that memory image and going through it: what was running, and what traces can be pulled out. Reac…"
canonical: "https://airmarket.ai/app/memory-forensics"
---

[Air Market](/) / [Security](/category/security) / Memory Forensics

Skill by [Seth Hobson](/@wshobson)

# Memory Forensics

Read what a machine was doing from a capture of its RAM

## What this does

Something happened on a machine and the evidence you need was only ever in memory. This covers taking that memory image and going through it: what was running, and what traces can be pulled out. Reach for it when investigating an incident or analysing malware from a RAM capture.

### Top 3 things it does for you

- Capture memory from a machine
- Examine what processes were running
- Pull artifacts out of a memory dump

## Information

**Memory Forensics at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Seth Hobson](/@wshobson) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 11 KB |
| Licence | MIT |
| Repository | [wshobson/agents](https://github.com/wshobson/agents/tree/be57c0b2e3c05c528ca6132b87410b385718775f/plugins/reverse-engineering/skills/memory-forensics) |
| GitHub stars | 39,077 (as of Nov 2026) |
| Installs | 11,458, counted by skills.sh (Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of Memory Forensics and flagged nothing. AIR's verdict: **safe**.

**What Memory Forensics's check was run against**

|  |  |
| --- | --- |
| Commit | be57c0b2e3c05c528ca6132b87410b385718775f |
| Content hash | fc26dd29ea693f7075e0bbdeb70a280712639dffafbce342aaea3a6bfc281f65 |
| Files read | [Browse the files at this exact commit](https://github.com/wshobson/agents/blob/be57c0b2e3c05c528ca6132b87410b385718775f/plugins/reverse-engineering/skills/memory-forensics/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for Memory Forensics](/security/memory-forensics)

## About Memory Forensics

Covers memory forensics technique: acquiring memory, analysing processes, and extracting artifacts using Volatility and related tools.

Applies when analysing memory dumps, investigating incidents, or performing malware analysis from RAM captures.

## What's inside

- SKILL.md - instructions
- references/details.md - reference

## Questions

### Is Memory Forensics safe to install?

AIR scanned this exact version of Memory Forensics and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit be57c0b2e3c0, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/memory-forensics.

### How do I install Memory Forensics?

Open https://airmarket.ai/app/memory-forensics on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/wshobson/agents/tree/be57c0b2e3c05c528ca6132b87410b385718775f/plugins/reverse-engineering/skills/memory-forensics. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by Seth Hobson](/@wshobson)

---

Canonical URL: <https://airmarket.ai/app/memory-forensics>