analyzing-slack-space-and-file-system-artifacts
CommunityReveal hidden NTFS data and reconstruct activity.
Data & Analytics#forensics#usn-journal#ntfs#mft#file-system-analysis#slack-space#alternate-data-streams
AuthorAxxxxxxaaann
Version1.0.0
Installs0
System Documentation
What problem does it solve?
This capability helps digital forensics teams uncover hidden and residual data within NTFS systems by analyzing slack space, MFT records, USN journals, and alternate data streams, enabling a coherent reconstruction of file activity.
Core Features & Use Cases
- Slack space analysis to recover residual data and uncover embedded artifacts.
- MFT and USN Journal inspection to map file lifecycle events (create, modify, delete, rename).
- ADS detection and extraction to reveal hidden data associated with files.
- End-to-end workflows for incident response and evidence timeline construction.
Quick Start
Run the Slack Space and File System Artifacts workflow against the forensic NTFS image to generate Slack, MFT, USN, and ADS findings.
Dependency Matrix
Required Modules
None requiredComponents
scriptsreferences
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: analyzing-slack-space-and-file-system-artifacts Download link: https://github.com/Axxxxxxaaann/KAIRI-Skills/archive/main.zip#analyzing-slack-space-and-file-system-artifacts Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.