> For the complete documentation index, see [llms.txt](https://www.iblue.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.iblue.team/memory-forensics-1.md).

# Memory Forensics

- [Volatility](https://www.iblue.team/memory-forensics-1/volatility-plugins.md): How to get Volatility2.6.1 working / workbench setup
- [Volatility3 core commands](https://www.iblue.team/memory-forensics-1/volatility-plugins/volatility3-core-commands.md)
- [Build Custom Linux Profile for Volatility](https://www.iblue.team/memory-forensics-1/volatility-plugins/build-custom-linux-profile-for-volatility.md)
- [Generate custom profile using btf2json](https://www.iblue.team/memory-forensics-1/volatility-plugins/generate-custom-profile-using-btf2json.md): How to use btf2json to generate a kernel profile for Volatility 3, without using a virtual machine and entirely within WSL.
- [Banners, isfinfo, and custom profiles](https://www.iblue.team/memory-forensics-1/volatility-plugins/banners-isfinfo-and-custom-profiles.md): How to force Volatility3 to use a specific (albeit mismatching) Linux kernel profile
- [Volatility2 core commands](https://www.iblue.team/memory-forensics-1/volatility-plugins/core-commands.md)
- [3rd Party Plugins](https://www.iblue.team/memory-forensics-1/volatility-plugins/3rd-party-plugins.md)
- [Acquisition](https://www.iblue.team/memory-forensics-1/acquisition.md)
- [ESXi / VMware Workstation snapshots](https://www.iblue.team/memory-forensics-1/acquisition/esxi-vmware-workstation-snapshots.md)
- [DumpIt](https://www.iblue.team/memory-forensics-1/acquisition/dumpit.md)
- [WinPMem](https://www.iblue.team/memory-forensics-1/acquisition/acquisition-with-winpmem.md)
- [Linux / AVML](https://www.iblue.team/memory-forensics-1/acquisition/linux-avml-acquisition.md)