skills.rest
aivos-xie
aivos-xieCOMMUNITY
Explore all skills by this author →
GitHub

digital-forensics

Analyze disk, memory, and network data for digital forensics investigations.

1|Updated Jun 9, 2026
Search Tags:#log analysis#file recovery#timeline analysis#memory forensics#digital forensics#cloud forensics#network forensics#metadata analysis#disk forensics
One-click install
npx skills add https://github.com/aivos-xie/hermes-skills --skill digital-forensics-aivos-xie
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: digital-forensics
Source: https://github.com/aivos-xie/hermes-skills/tree/main/security/digital-forensics
Command: npx skills add https://github.com/aivos-xie/hermes-skills --skill digital-forensics-aivos-xie

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires autopsy, sleuthkit, volatility, wireshark, python, plaso, chainsaw, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a comprehensive toolkit for digital forensics, enabling users to analyze disks, memory, and network data, reconstruct timelines, and extract valuable information from various sources.

Core Features & Use Cases

  • Disk Forensics: Create disk images, analyze file systems, and recover deleted files.
  • Memory Forensics: Extract system and process information from memory dumps.
  • Network Forensics: Analyze network traffic and extract relevant data.
  • Log Analysis: Reconstruct timelines and identify security incidents.
  • File Recovery: Restore lost files from disk images.
  • Metadata Analysis: Extract and analyze metadata from files.
  • Timeline Analysis: Create and analyze event timelines.
  • Cloud/Container Forensics: Analyze Docker containers and AWS cloud data.
  • Use Case: If you suspect a security breach, this Skill can help you analyze system logs, memory dumps, and network traffic to identify the source and extent of the breach.

Quick Start

Use the digital-forensics skill to analyze the disk image 'crash.dump' for signs of a security breach.

Frequently Asked Questions about digital-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform memory forensics to extract process information from a crash dump?▼

Memory forensics extracts system and process information from memory dumps using Volatility. You can analyze a crash dump to identify malicious processes, injected code, and system anomalies during incident response or security breach investigations.

What is the best way to reconstruct a timeline from system logs and disk images?▼

Timeline analysis reconstructs event sequences from system logs and file system metadata using Plaso. This technique correlates timestamps across disk images and network logs to identify the exact source and extent of a security breach.

Can I recover deleted files and analyze file systems using Autopsy and The Sleuth Kit?▼

Yes, disk forensics with Autopsy and The Sleuth Kit recovers deleted files and analyzes file systems from disk images. This process extracts valuable metadata and restores lost data for legal investigations and security audits.

Do I need Wireshark installed for network forensics and traffic analysis?▼

Yes, Wireshark is required for network forensics to analyze network traffic and extract relevant data. It captures and inspects packet details to help identify unauthorized communications and the network footprint of security incidents.

How does digital forensics apply to cloud environments and Docker containers?▼

Cloud and container forensics analyzes Docker containers and AWS cloud data to identify security breaches in modern infrastructure. This process extracts system logs and metadata from cloud instances to support incident response.

What is metadata analysis in digital forensics and when do I need it?▼

Metadata analysis extracts and examines file attributes, timestamps, and hidden properties from digital evidence. You need this technique during security audits and legal investigations to verify file authenticity and reconstruct event timelines.

Related Skills

Explore More Legal & Compliance Skills→
brucesongsbrucesongs
60

digital-forensics

Analyze disk images, memory dumps, and network artifacts with forensic tools.

Community
Advanced
SherifEldeebSherifEldeeb
5

forensic-reporting

Generate formal forensic reports from investigation findings and evidence.

Community
Advanced
hypnguyen1209hypnguyen1209
338

incident-response

Orchestrate evidence collection, timeline reconstruction, and forensic reporting for security incidents.

Community
Advanced
jaskaranhundaljaskaranhundal
3

forensics

Reconstruct digital forensics timelines and extract Indicators of Compromise.

Community
Advanced