skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

artifact-collection

Collect digital forensic artifacts from Windows, Linux, macOS endpoints with chain of custody records.

5|Updated Jan 12, 2026
Search Tags:#cross-platform#endpoint#forensics#incident-response#artifact-collection#chain-of-custody#evidence-packaging
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill artifact-collection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: artifact-collection
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/forensics/artifact-collection
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill artifact-collection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Collects and preserves digital forensic artifacts from endpoints to support incident response, investigations, and legal proceedings, ensuring evidence integrity.

Core Features & Use Cases

  • Volatile Data Collection: RAM, processes, and network state from live systems
  • Disk Artifact Collection: Registry, logs, browser data, and configuration snapshots
  • Chain of Custody: Generates and maintains an auditable handling record
  • Remote and selective collection: Gather artifacts from remote hosts or targeted types
  • Verification & packaging: Hashing and packaging for integrity
  • Cross-platform support: Windows, Linux, macOS artifact collection

Quick Start

To begin, initialize the appropriate collector (e.g., WindowsCollector) and run the collection steps for volatile and disk artifacts, then generate a custody and evidence package as needed.

Frequently Asked Questions about artifact-collection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I collect and preserve volatile data like RAM and network state during incident response?▼

Volatile data collection gathers RAM, running processes, and network state from live systems during incident response. The artifact-collection Skill captures this live system data across Windows, Linux, and macOS while maintaining an auditable chain of custody.

What is the best way to maintain chain of custody when gathering forensic artifacts from endpoints?▼

Maintaining chain of custody during forensic artifact collection requires generating an auditable handling record, hashing for verification, and secure evidence packaging. This Skill automates custody record generation alongside volatile and disk artifact gathering.

Does this forensic artifact collection method support Windows, Linux, and macOS endpoints?▼

Cross-platform forensic artifact collection supports Windows, Linux, and macOS endpoints. It relies on Python 3.9+ and optional tools like volatility3, psutil, and wmi to gather volatile and non-volatile data across these operating systems.

How do I collect disk artifacts like registry, logs, and browser data for investigations?▼

Disk artifact collection gathers registry entries, system logs, browser data, and configuration snapshots from endpoints. You initialize the appropriate collector, run collection steps for targeted artifact types, and generate a packaged evidence record.

Can I gather forensic artifacts remotely from targeted hosts during a legal hold?▼

Remote and selective forensic artifact collection allows gathering targeted data types from remote hosts. This supports incident response, investigations, and legal holds by capturing specific evidence while ensuring integrity through hashing and packaging.

Do I need Python 3.9 or volatility3 installed to collect digital forensic artifacts?▼

Collecting digital forensic artifacts requires Python 3.9+ as a dependency. Optional tools like volatility3, psutil, and wmi enhance collection capabilities for volatile data and platform-specific disk artifacts across supported operating systems.

Related Skills

Explore More Data & Analytics Skills→
SherifEldeebSherifEldeeb
5

disk-forensics

Analyze disk images and file systems for forensic investigations.

Community
Advanced
projectedanxprojectedanx
1

oss-forensics

Analyze GitHub repositories for supply chain attacks using git, API, and logs.

Community
Advanced
JingyueCongJingyueCong

memory-forensics

Analyze memory dumps with Volatility to identify forensic artifacts and suspicious activity.

Community
Advanced
AgentSecOpsAgentSecOps
183

ir-velociraptor

Analyze endpoint telemetry and artifacts for incident response with Velociraptor VQL workflows.

Official
Advanced