What tools are integrated into the workflow?

The skill provides expert guidance for industry-standard tools including Volatility3, Autopsy, Plaso (log2timeline), Wireshark, and NetworkMiner.

Which forensic standards does it follow?

It adheres to NIST SP 800-86 (Guide to Integrating Forensic Techniques), RFC 3227 (Evidence Collection Guidelines), and ACPO Good Practice Guides.

How does this skill ensure forensic integrity?

The skill enforces the use of write-blockers, SHA-256 hashing at acquisition, and strictly works on forensic copies rather than original evidence to ensure findings are defensible.

Can it analyze cloud platform logs?

Yes, it has specialized context for reconstructing events from Supabase audit logs, Vercel deployment traces, Stripe events, and GitHub Actions history.

Forensics Investigator

Name: Forensics Investigator
Author: coreymaypray

bycoreymaypray

0•

Security & Testing

Conducts professional-grade digital forensic investigations to reconstruct attack timelines and preserve evidentiary integrity after security breaches.

The Forensics Investigator skill empowers Claude to act as a specialized digital forensics expert, capable of answering the most difficult post-breach questions. It provides a rigorous framework for memory analysis, disk forensics, and log artifact correlation while strictly adhering to standards like NIST SP 800-86 and RFC 3227. By focusing on the order of volatility and maintaining a defensible chain of custody, this skill helps teams identify root causes, extract indicators of compromise (IOCs), and produce legal-ready reports for incident response, insurance claims, or law enforcement proceedings.

Key Features

01Unified timeline reconstruction across memory, disk, and cloud logs

02Cloud-native forensic analysis for Supabase, Vercel, and GitHub Actions

03Chain of custody documentation with SHA-256 hashing and verification

04Disk image and file system analysis with Autopsy and Sleuth Kit

050 GitHub stars

06Memory forensics and process tree analysis using Volatility3

Use Cases

01Investigating insider threats through browser forensics and registry hive analysis

02Reconstructing a step-by-step attack timeline to identify the entry point and lateral movement

03Analyzing ransomware artifacts to determine the scope of data encryption and exfiltration

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add coreymaypray/sloth-skill-tree forensics-investigator

For use in Claude.ai and ChatGPT

Key Features

01Unified timeline reconstruction across memory, disk, and cloud logs

02Cloud-native forensic analysis for Supabase, Vercel, and GitHub Actions

03Chain of custody documentation with SHA-256 hashing and verification

04Disk image and file system analysis with Autopsy and Sleuth Kit

050 GitHub stars

06Memory forensics and process tree analysis using Volatility3

Use Cases

01Investigating insider threats through browser forensics and registry hive analysis

02Reconstructing a step-by-step attack timeline to identify the entry point and lateral movement

03Analyzing ransomware artifacts to determine the scope of data encryption and exfiltration

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add coreymaypray/sloth-skill-tree forensics-investigator

For use in Claude.ai and ChatGPT