Forensic Analyst

概要

Empower your security operations with expert guidance for deep-dive forensic analysis and incident response. This skill enables systematic investigation of security breaches by providing structured methodologies for preserving volatile data, collecting file system evidence, and performing complex timeline reconstruction using LimaCharlie's powerful sensor commands and LCQL syntax. Whether you are tracking a live intrusion, analyzing memory dumps for hidden malware, or building evidence-based reports for legal compliance, it ensures that your investigation maintains strict chain of custody and adheres to core digital forensics principles across both Windows and Linux environments.

主な機能

• Comprehensive artifact reference for Windows execution and Linux persistence locations
• Pre-configured LCQL patterns for process, network, and file activity timelines
• Deep-dive memory analysis including mapping, string extraction, and handle listing
• Dynamic epoch timestamp calculation for precise relative time queries
• Six-phase forensic methodology covering identification through reporting
• 0 GitHub stars

ユースケース

• Collecting and preserving forensically sound evidence for compliance or legal proceedings
• Reconstructing chronological attack timelines to identify root causes and impact
• Investigating active ransomware incidents or unauthorized system intrusions