skills.rest
brucesongs
brucesongsCOMMUNITY
Explore all skills by this author →
GitHub

digital-forensics

Analyze disk images, memory dumps, and network artifacts with forensic tools.

60|14|Updated Apr 27, 2026
Search Tags:#volatility#digital-forensics#memory-forensics#autopsy#timeline-analysis#disk-imaging#sleuthkit
One-click install
npx skills add https://github.com/brucesongs/kali-claw --skill digital-forensics-brucesongs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: digital-forensics
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/digital-forensics
Command: npx skills add https://github.com/brucesongs/kali-claw --skill digital-forensics-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Digital forensics workflows often require juggling multiple tools and evolving techniques. This Skill provides a cohesive, self-contained reference with workflows, payloads, and guidance to systematically acquire, analyze, and report digital evidence across disk images, memory dumps, logs, and network captures.

Core Features & Use Cases

  • End-to-end forensics workflows across disk imaging, file carving, memory forensics, and network forensics
  • Tool guidance for SleuthKit, Autopsy, Volatility, Bulk Extractor, ExifTool, PhotoRec, and TestDisk
  • Test cases and payload references for structured validation and learning
  • Timeline reconstruction and chain-of-custody documentation to support admissibility

Quick Start

Start by reviewing the payloads.md and test-cases.md to perform an end-to-end digital-forensics workflow on a sample disk image.

Frequently Asked Questions about digital-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform memory forensics analysis on a memory dump using Volatility?▼

Memory forensics with Volatility involves applying structured workflows to analyze memory dumps, reconstruct digital evidence, and support incident response investigations. This Skill provides guidance for using Volatility alongside other tools to systematically process memory artifacts.

What is the best way to reconstruct a timeline from disk images and network artifacts?▼

Timeline analysis reconstructs digital evidence by correlating timestamps from disk images, memory dumps, and network captures. This Skill guides you through timeline reconstruction using SleuthKit, Autopsy, and other tools to support forensic investigations and compliance reviews.

Can I use Autopsy and SleuthKit together for disk imaging and file carving workflows?▼

Yes, Autopsy and SleuthKit can be used together for disk imaging and file carving workflows. This Skill provides end-to-end guidance for using both tools to acquire and analyze disk images, extract files, and document evidence for incident response.

Does this digital forensics workflow support chain-of-custody documentation for compliance reviews?▼

Digital forensics workflows in this Skill include chain-of-custody documentation to support evidence admissibility during compliance reviews. Structured guidance covers evidence collection, analysis, and reporting to maintain proper documentation throughout the investigation process.

How do I extract metadata and EXIF information from digital evidence files?▼

Extracting metadata from digital evidence files is handled through ExifTool guidance included in this Skill. The workflows cover applying ExifTool to analyze file metadata, supporting broader forensic investigations alongside tools like Bulk Extractor and PhotoRec.

Related Skills

Explore More Data & Analytics Skills→
bpnrockstarbpnrockstar

forensics

Analyze disk images, memory dumps, and packet captures for incident response.

Community
Advanced
SherifEldeebSherifEldeeb
5

forensic-reporting

Generate formal forensic reports from investigation findings and evidence.

Community
Advanced
aivos-xieaivos-xie
1

digital-forensics

Analyze disk, memory, and network data for digital forensics investigations.

Community
Advanced
tekgrunttekgrunt

forensic-analyst

Preserve evidence, reconstruct attack timelines, and generate auditable forensic reports using LimaCharlie.

Community
Advanced