diff --git a/cheat_sheets/mem-forensics.pdf b/cheat_sheets/mem-forensics.pdf
new file mode 100644
index 0000000..2062b78
Binary files /dev/null and b/cheat_sheets/mem-forensics.pdf differ