Analyze disk images and file systems for forensic investigations.
npx skills add https://github.com/SherifEldeeb/agentskills --skill disk-forensics
Please help me install this Agent Skill. Skill: disk-forensics Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/forensics/disk-forensics Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill disk-forensics
Analyze disk images and file systems for forensic investigations. This skill helps investigators uncover artifacts, recover deleted data, and build a comprehensive storage-media timeline during incident response.
Use the disk-forensics skill to initialize a DiskAnalyzer with a disk image path, list volumes, recover deleted files, analyze MFT entries, and export reports.
High-intent search queries and answers about installing and using this skill.
To recover deleted files from an NTFS disk image, you parse the Master File Table (MFT) and file system metadata using carving techniques to extract artifacts and residual data. This skill automates that extraction process directly from disk images.
Slack space analysis in digital forensics is the examination of hidden or residual data stored in unused file system clusters. You need it to uncover concealed artifacts, such as hidden text or deleted data fragments, bypassing standard file viewing.
Yes, disk forensics analysis supports EXT and HFS+ file systems, alongside NTFS, FAT, and APFS. It parses these file systems to build a comprehensive storage-media timeline during incident response investigations.
To analyze NTFS Alternate Data Streams (ADS) and hidden partitions, you inspect partition tables and extract ADS content to detect hidden data. This skill identifies these concealed storage artifacts within disk images.
Yes, you need Python 3.9+ and optional tools such as The Sleuth Kit, pytsk3, pyewf, and libewf to achieve full disk image analysis capability. These dependencies enable deep partition analysis and MFT parsing.
Yes, you can verify file signatures and detect mismatched extensions in storage artifacts. This skill analyzes file signatures to detect discrepancies between a file's claimed extension and its actual binary data format.
mietheGenerate a validated style specification with SHA-256 provenance hash.
YukiIto1999Automate disk-forensics analysis of forensic disk images with hash verification and timeline reconstruction.
letta-aiRecover passwords and sensitive data from disk images and deleted files.
jd-opensourceIdentify and extract artifacts from memory dumps, PCAPs, and disk images.
