Run complete automated triage of memory dump. Uses Rust engine for fast data collection and Python analyzers for correlation. Produces executive summary with risk level, prioritized findings, and IOCs.

Initialize memory image analysis. Tries Rust engine first (fast ISF auto-detection), falls back to Vol3. Returns session ID for subsequent operations.

List all active memory analysis sessions. Shows session IDs, image paths, and engine status.

Get status and capabilities. Shows available engines (Rust/Vol3) and what analyses can be performed.

Detect hidden processes, unusual parent-child relationships, and suspicious process attributes. Uses Rust pslist+psscan for data, Python analyzer for correlation.

Get process tree showing parent-child relationships. Highlights suspicious processes.

Scan for code injection. Uses Rust malfind (fast), falls back to Vol3 malfind + YARA.

Find suspicious network connections. Uses Rust netscan for data, Python for C2 analysis.

Recover attacker commands from cmd.exe history and process command lines. Uses Rust cmdscan, enriched by Vol3.

Extract credential artifacts via Vol3: NTLM hashes (SAM), LSA secrets, cached domain credentials.

Run a forensics plugin. Tier 1 (Rust, fast): pslist, psscan, cmdline, dlllist, malfind, netscan, cmdscan, search, readraw, rsds — use short names. Tier 3 (Vol3): any other plugin — short names auto-resolve (e.g. 'filescan', 'handles', 'envars'). If a short name fails, use full Vol3 path: 'windows.category.PluginName' (e.g. 'windows.mftscan.MFTScan'). Use 'filter' param to grep results server-side (avoids truncation). For search: use params={"pattern": "text", "encoding": "ascii|utf16le|hex", "limit": N, "context": N}.

List all available plugins (Rust + Vol3).

Get process info including memory regions and loaded DLLs.

Examine a specific VAD (memory region). Useful for injected code regions.

List files that can be extracted from memory cache.