skills.rest
drupadsachania
drupadsachaniaCOMMUNITY
Explore all skills by this author →
GitHub

digital-forensics

Orchestrate DFIR phases from evidence acquisition to timeline reconstruction.

Updated May 22, 2026
Search Tags:#incident-response#dfir#timeline-reconstruction#digital-forensics#chain-of-custody#memory-forensics#disk-forensics
One-click install
npx skills add https://github.com/drupadsachania/aegis-skills --skill digital-forensics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: digital-forensics
Source: https://github.com/drupadsachania/aegis-skills/tree/main/skills/digital-forensics
Command: npx skills add https://github.com/drupadsachania/aegis-skills --skill digital-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

End-to-end DFIR workflow that standardizes evidence collection, analysis, and timeline reconstruction with chain-of-custody discipline.

Core Features & Use Cases

  • MITRE-ATT&CK-aligned DFIR phases: evidence-acquisition, disk-forensics, memory-forensics, network-forensics, cloud-and-mobile, timeline-reconstruction.
  • Phase lazy-loading via references to keep workflows modular and scalable for investigations across enterprise, cloud, and hybrid environments.
  • Cross-platform applicability: supports multi-model deployments (OpenAI GPT-4o, Gemini, Claude, Mistral) for defensive operations and incident response.

Quick Start

Invoke the digital-forensics skill to start a phase-driven DFIR workflow and begin structured evidence analysis.

Frequently Asked Questions about digital-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I structure a digital forensics workflow for enterprise incident response?▼

A digital forensics workflow for incident response is structured through modular phases, applying evidence acquisition, disk and memory forensics, and timeline reconstruction with strict chain-of-custody discipline across enterprise environments.

What is timeline reconstruction in DFIR and when is it needed?▼

Timeline reconstruction in DFIR is the cross-source correlation of evidence from disk, memory, and cloud data to map event sequences. It is needed during incident response and legal hold to establish what occurred across enterprise systems.

Can I use this DFIR workflow with Claude and Gemini for security investigations?▼

Yes, this DFIR workflow supports cross-platform deployment to OpenAI GPT-4o, Gemini, Claude, and Mistral, allowing defensive operations and security investigations to run modular phases across multiple AI models.

How do I handle evidence acquisition and memory forensics in hybrid cloud environments?▼

Evidence acquisition and memory forensics in hybrid cloud environments are handled through modular phases with lazy-loading references, scaling collection and cross-source correlation across cloud, mobile, and enterprise infrastructure.

Does this incident response workflow align with MITRE ATT&CK coverage?▼

Yes, the incident response workflow aligns with MITRE ATT&CK coverage, mapping disk, memory, and network forensics phases to standard adversary tactics and techniques during security investigations and timeline reconstruction.

Related Skills

Explore More Legal & Compliance Skills→
daemon-blockint-techdaemon-blockint-tech
7

digital-forensics-analyst

Identify and preserve forensic artifacts with chain-of-custody documentation.

Community
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
KongGithubDevKongGithubDev

ctf-forensics

Automate digital forensics workflows for CTF challenges using Volatility 3 and open-source tools.

Community
Advanced
bpnrockstarbpnrockstar

forensics

Analyze disk images, memory dumps, and packet captures for incident response.

Community
Advanced