skills.rest
Fuzzdkk
FuzzdkkCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

disk-forensics

Identify and extract disk artifacts from disk images using Sleuthkit, binwalk, strings, and bulk_extractor.

3|Updated Apr 10, 2026
Search Tags:#timeline#filesystem#forensics#disk-forensics#artifact-recovery#sleuthkit#bulk-extractor
One-click install
npx skills add https://github.com/Fuzzdkk/dfir-skills --skill disk-forensics-fuzzdkk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: disk-forensics
Source: https://github.com/Fuzzdkk/dfir-skills/tree/main/disk-forensics
Command: npx skills add https://github.com/Fuzzdkk/dfir-skills --skill disk-forensics-fuzzdkk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Disk images often contain scattered artefacts across partitions, deleted files, and hidden timelines. This skill provides a repeatable, end-to-end approach to recover those artifacts, reconstruct timelines, and expose evidence from Sleuthkit, binwalk, strings, and bulk_extractor.

Core Features & Use Cases

  • Partition identification and filesystem analysis with Sleuthkit to map data layout.
  • Deleted file recovery and artifact extraction to support timeline construction.
  • Cross-platform artifact analysis across Windows and Linux images using common forensic tools.
  • Timeline building to correlate events across multiple evidence sources for investigations.

Quick Start

Provide a disk image path to initiate partition identification, artifact recovery, and timeline construction.

Frequently Asked Questions about disk-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover deleted files and reconstruct a timeline from a disk image?▼

Recover deleted files and reconstruct a timeline from a disk image by coordinating Sleuthkit, binwalk, strings, and bulk_extractor to identify partitions, extract artifacts, and correlate events across Windows and Linux filesystems into a comprehensive forensic report.

Can Sleuthkit and bulk_extractor work together for cross-platform artifact analysis?▼

Sleuthkit and bulk_extractor work together for cross-platform artifact analysis by combining filesystem partition mapping and deleted file recovery with bulk data extraction across Windows and Linux images to produce coherent evidence.

What is the process for identifying partition offsets in a disk image for forensic analysis?▼

Identifying partition offsets in a disk image involves using Sleuthkit to map the data layout, validate recovered files, and extract image metadata to support accurate timeline reconstruction and partition-specific artifact recovery.

How do I extract strings and hidden artifacts from a disk image?▼

Extract strings and hidden artifacts from a disk image by using binwalk and strings to scan raw partitions, validate recovered files, and generate forensic evidence correlated across multiple sources for investigation timelines.

Does disk forensics support both Windows and Linux filesystem recovery?▼

Disk forensics supports both Windows and Linux filesystem recovery by performing cross-platform artifact analysis, validating recovered files, and reconstructing timelines using Sleuthkit and bulk_extractor across varied partition layouts.

What's the best way to build a forensic timeline from multiple evidence sources?▼

Build a forensic timeline from multiple evidence sources by coordinating Sleuthkit, binwalk, and bulk_extractor to extract and correlate artifacts, reconstructing a comprehensive evidence timeline for cross-platform investigations.

Related Skills

Explore More Data & Analytics Skills→
L3DigitalNetL3DigitalNet
6

lsblk

List block devices in a tree hierarchy with mount points and filesystem details.

Official
Basic
trungdo9trungdo9
3

cti-expert

Automate cyber threat intelligence investigations using OSINT and forensic analysis.

Community
Advanced
as4584as4584
2

memory-forensics

Analyzes volatile memory dumps using Volatility 3 to extract processes, networks, and artifacts.

Community
Advanced
JingyueCongJingyueCong

memory-forensics

Analyze memory dumps with Volatility to identify forensic artifacts and suspicious activity.

Community
Advanced