Does it handle Windows-specific artifacts?

Yes, it includes detailed procedures for parsing NTFS-specific artifacts like the Master File Table (MFT), Registry hives, Prefetch files, and ShellBags.

Is it compliant with legal standards?

The skill follows industry best practices, including chain of custody documentation and hash verification (SHA-256), which are essential for evidence to be admissible.

Can it recover deleted files?

Yes, the skill includes guidance on file carving and analyzing unallocated space to recover files and directories that have been deleted but not yet overwritten.

Does this skill support physical drive imaging?

Yes, it provides workflows for using hardware write blockers and software tools like FTK Imager or dcfldd to create bit-for-bit forensic images from physical media.

Disk Forensics Investigation

Name: Disk Forensics Investigation
Author: mukul975

bymukul975

•

4,121

•

Security & Testing

Conducts deep-dive digital forensic investigations on disk images to recover evidence, reconstruct timelines, and identify security breaches.

This skill empowers AI agents to perform structured disk forensics, following industry-standard workflows for evidence preservation and analysis. It guides the user through secure imaging, file system examination (NTFS, ext4, APFS), artifact recovery (Registry, Prefetch, Event Logs), and timeline reconstruction to support incident response and legal proceedings. It is specifically designed for cybersecurity professionals needing to analyze compromised workstations or investigate data exfiltration while maintaining a rigorous chain of custody and evidence integrity.

Key Features

01Structured forensic reporting and documentation templates

02File system analysis and deleted file recovery (carving)

034,121 GitHub stars

04Automated timeline reconstruction from metadata

05Forensic imaging and hash verification (SHA-256)

06Windows artifact extraction (MFT, Registry, Prefetch, Jump Lists)

Use Cases

01Analyzing compromised systems to identify malware persistence and entry points

02Investigating insider threats and unauthorized data copying to USB drives

03Recovering deleted evidence and reconstructing user activity for legal proceedings

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills performing-disk-forensics-investigation

For use in Claude.ai and ChatGPT

Key Features

01Structured forensic reporting and documentation templates

02File system analysis and deleted file recovery (carving)

034,121 GitHub stars

04Automated timeline reconstruction from metadata

05Forensic imaging and hash verification (SHA-256)

06Windows artifact extraction (MFT, Registry, Prefetch, Jump Lists)

Use Cases

01Analyzing compromised systems to identify malware persistence and entry points

02Investigating insider threats and unauthorized data copying to USB drives

03Recovering deleted evidence and reconstructing user activity for legal proceedings

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills performing-disk-forensics-investigation

For use in Claude.ai and ChatGPT