Форензик-анализ памяти Linux с LiME и Volatility

★ 8.4 · security

analyzing-memory-forensics-with-lime-and-volatility is a Claude Code skill that performs Linux memory acquisition using the LiME (Linux Memory Extractor) kernel module and forensic analysis with the Volatility 3 framework. The skill covers a complete forensic workflow: capturing a memory image via insmod in lime or raw format, then running vol3 plugins to extract process lists (linux.pslist, linux.psscan), bash command history, network connections (linux.sockstat), loaded kernel modules (linux.lsmod), and injected code artifacts (linux.malfind). It targets SOC analysts and incident responders investigating compromised Linux systems, hunting for rootkits, or reconstructing an attack from volatile memory. The skill maps to MITRE ATT&CK techniques T1055, T1003.001, T1620, and T1564.001.