665,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-slack-space-and-file-system-artifacts

Analyze NTFS artifacts to reconstruct file activity from disk images.

Updated Aug 27, 2026

Search Tags:#forensics #usn-journal #ntfs #mft #file-system-analysis #slack-space #alternate-data-streams

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-slack-space-and-file-system-artifacts

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-slack-space-and-file-system-artifacts
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-slack-space-and-file-system-artifacts
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-slack-space-and-file-system-artifacts

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This capability helps digital forensics teams uncover hidden and residual data within NTFS systems by analyzing slack space, MFT records, USN journals, and alternate data streams, enabling a coherent reconstruction of file activity.

Core Features & Use Cases

Slack space analysis to recover residual data and uncover embedded artifacts.
MFT and USN Journal inspection to map file lifecycle events (create, modify, delete, rename).
ADS detection and extraction to reveal hidden data associated with files.
End-to-end workflows for incident response and evidence timeline construction.

Quick Start

Run the Slack Space and File System Artifacts workflow against the forensic NTFS image to generate Slack, MFT, USN, and ADS findings.

Frequently Asked Questions about analyzing-slack-space-and-file-system-artifacts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze NTFS slack space to recover hidden forensic artifacts?▼

To analyze NTFS slack space, you run the workflow against a forensic disk image to extract residual data and uncover embedded artifacts. It leverages bulk_extractor and The Sleuth Kit to parse slack space and generate structured findings.

What is the best way to reconstruct file activity from MFT and USN journal records?▼

Reconstructing file activity from MFT and USN journals maps file lifecycle events like creation, modification, deletion, and renaming. This Skill uses MFTECmd and analyzeMFT to parse records and build coherent incident response timelines.

How do I detect and extract alternate data streams in NTFS during incident response?▼

Detecting alternate data streams (ADS) in NTFS reveals hidden data associated with files. This Skill identifies and extracts ADS from disk images, providing structured findings to support incident response and evidence timeline construction.

Can I use Sleuth Kit and MFTECmd together for NTFS file system analysis?▼

Yes, you can use The Sleuth Kit and MFTECmd together for NTFS file system analysis. This Skill leverages them alongside analyzeMFT and bulk_extractor to parse MFT metadata, USN journals, and slack space for forensic investigations.

Do I need a disk image to inspect NTFS artifacts and build an evidence timeline?▼

Yes, you need a forensic NTFS disk image to inspect artifacts and build an evidence timeline. This Skill processes disk images containing slack space, MFT metadata, USN journals, and alternate data streams to reconstruct file activity.

Related Skills

Explore More Data & Analytics Skills→

claude-code-history-files-finder

Parse Claude Code session JSONL files to recover deleted content and generate reports.

performing-linux-log-forensics-investigation

Analyze Linux system logs to reconstruct user activity and detect unauthorized access.

salmanabdurrahman

ctf-forensics-disk

Analyze disk images and memory dumps with Sleuth Kit, Volatility, and hashcat.

memory-forensics

Analyzes volatile memory dumps using Volatility 3 to extract processes, networks, and artifacts.