digital-forensics

Name: digital-forensics
Availability: InStock
Author: brucesongs

Analyze disk images, memory dumps, and network artifacts with forensic tools.

60|14|Updated Apr 27, 2026

Search Tags:#volatility #digital-forensics #memory-forensics #autopsy #timeline-analysis #disk-imaging #sleuthkit

Ready to run

npx skills add https://github.com/brucesongs/kali-claw --skill digital-forensics-brucesongs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: digital-forensics
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/digital-forensics
Command: npx skills add https://github.com/brucesongs/kali-claw --skill digital-forensics-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Digital forensics workflows often require juggling multiple tools and evolving techniques. This Skill provides a cohesive, self-contained reference with workflows, payloads, and guidance to systematically acquire, analyze, and report digital evidence across disk images, memory dumps, logs, and network captures.

Core Features & Use Cases

End-to-end forensics workflows across disk imaging, file carving, memory forensics, and network forensics
Tool guidance for SleuthKit, Autopsy, Volatility, Bulk Extractor, ExifTool, PhotoRec, and TestDisk
Test cases and payload references for structured validation and learning
Timeline reconstruction and chain-of-custody documentation to support admissibility

Quick Start

Start by reviewing the payloads.md and test-cases.md to perform an end-to-end digital-forensics workflow on a sample disk image.

Frequently Asked Questions about digital-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform memory forensics analysis on a memory dump using Volatility?▼

Memory forensics with Volatility involves applying structured workflows to analyze memory dumps, reconstruct digital evidence, and support incident response investigations. This Skill provides guidance for using Volatility alongside other tools to systematically process memory artifacts.

What is the best way to reconstruct a timeline from disk images and network artifacts?▼

Timeline analysis reconstructs digital evidence by correlating timestamps from disk images, memory dumps, and network captures. This Skill guides you through timeline reconstruction using SleuthKit, Autopsy, and other tools to support forensic investigations and compliance reviews.

Can I use Autopsy and SleuthKit together for disk imaging and file carving workflows?▼

Yes, Autopsy and SleuthKit can be used together for disk imaging and file carving workflows. This Skill provides end-to-end guidance for using both tools to acquire and analyze disk images, extract files, and document evidence for incident response.

Does this digital forensics workflow support chain-of-custody documentation for compliance reviews?▼

Digital forensics workflows in this Skill include chain-of-custody documentation to support evidence admissibility during compliance reviews. Structured guidance covers evidence collection, analysis, and reporting to maintain proper documentation throughout the investigation process.

How do I extract metadata and EXIF information from digital evidence files?▼

Extracting metadata from digital evidence files is handled through ExifTool guidance included in this Skill. The workflows cover applying ExifTool to analyze file metadata, supporting broader forensic investigations alongside tools like Bulk Extractor and PhotoRec.