memory-triage

Structured first-pass triage of an unknown memory image. Use when handed a .mem/.raw/.vmem/.dmp/.lime/.bin/.aff4 and asked "what happened on this box?" — establishes ground truth before any targeted hunt.