skills.rest
mgreen27
mgreen27COMMUNITY
Explore all skills by this author →
Website𝕏@mgreen27GitHub

add-velociraptor-mapped-client

Attach offline evidence disks or directories to Velociraptor GUI environments.

Updated Aug 27, 2026
Search Tags:#automation#evidence#remapping#forensics#velociraptor#disks
One-click install
npx skills add https://github.com/mgreen27/dfir-skills --skill add-velociraptor-mapped-client
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: add-velociraptor-mapped-client
Source: https://github.com/mgreen27/dfir-skills/tree/main/skills/add-velociraptor-mapped-client
Command: npx skills add https://github.com/mgreen27/dfir-skills --skill add-velociraptor-mapped-client

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, awk, sed, basename, wc, date, nohup, grep, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill simplifies the process of attaching an offline Windows evidence image or mounted directory to a Velociraptor GUI workspace for forensic analysis.

Core Features & Use Cases

  • Evidence Integration: Automatically remap and connect dead-disk images or directories to Velociraptor for review.
  • Workflow Automation: Generates remapping files, validates configurations, and manages client supervision commands to ensure consistent access to evidence.
  • Use Case: For incident responders handling forensic images, quickly set up Velociraptor clients to interrogate evidence without manual configuration.

Quick Start

Run the script with the path to your evidence image or mounted directory to automatically attach and start the Velociraptor client session.

Frequently Asked Questions about add-velociraptor-mapped-client

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I attach an offline forensic evidence disk to Velociraptor for analysis?▼

To attach offline forensic evidence disks to Velociraptor, you can use this Skill to automatically remap dead-disk images or mounted directories and connect them to the Velociraptor GUI for review.

Can I automate the remapping of mounted directories in Velociraptor workflows?▼

Yes, you can automate remapping mounted directories in Velociraptor by using this Skill to generate remapping files, validate configurations, and manage client supervision commands for consistent access.

Does Velociraptor offline evidence analysis require manual client configuration?▼

Velociraptor offline evidence analysis does not require manual client configuration because this Skill automates the process, allowing incident responders to quickly set up clients and interrogate evidence.

What is the best way to connect dead-disk images to a Velociraptor GUI environment?▼

The best way to connect dead-disk images to a Velociraptor GUI environment is by running this Skill with the path to your evidence image to automatically attach and start the client session.

Do I need to manually validate remapping files when connecting evidence to Velociraptor?▼

You do not need to manually validate remapping files when connecting evidence to Velociraptor, as this Skill automatically handles the validation of configurations and process management for offline analysis workflows.

Related Skills

Explore More Data & Analytics Skills→
rjonhaasrjonhaas
1

Threat Hunting & IOC Sweeps (YARA / Velociraptor)

Scan file systems and memory images with YARA and endpoints via Velociraptor hunts.

Community
Intermediate
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced
bbohhu-progbbohhu-prog

deploy-project

Deploy Node.js, Python, or Go projects to remote servers with automated domain and TLS configuration.

Community
Advanced
AgentSecOpsAgentSecOps
183

ir-velociraptor

Analyze endpoint telemetry and artifacts for incident response with Velociraptor VQL workflows.

Official
Advanced