Extract forensic artifacts from PST, OST, MBX, EML, and MSG email files.
npx skills add https://github.com/erlebach/gordon --skill email-forensics-erlebach
Please help me install this Agent Skill. Skill: email-forensics Source: https://github.com/erlebach/gordon/tree/main/skills/email-forensics Command: npx skills add https://github.com/erlebach/gordon --skill email-forensics-erlebach
Email investigations require collecting messages from multiple formats, parsing content, and extracting artifacts to establish a credible timeline and evidence.
Provide a mailbox or email file and request a forensic analysis and a comprehensive report.
High-intent search queries and answers about installing and using this skill.
Extract forensic artifacts from PST, OST, MBOX, EML, and MSG files by parsing mailbox data to detect phishing, spoofing, and BEC indicators. Apply the analysis to individual emails or archives to generate metadata timelines and threat reports.
Detect email spoofing and BEC indicators by performing header and routing analysis on mailbox archives. This process examines authentication results and metadata anomalies to identify malicious messages and reconstruct evidence-ready timelines.
Reconstruct email timelines and thread history from MBOX and MSG formats by parsing message metadata and content. This forensic analysis establishes a credible sequence of events for incident response and evidence collection.
Email forensics analysis supports exporting IOCs, attachments, and reconstructed threads for incident reporting. It generates comprehensive reports from parsed mailbox data, with optional threat intelligence integrations for deeper investigation.
Analyze email headers to find routing anomalies and authentication failures by examining the message transmission path. This forensic process detects spoofing attempts and metadata inconsistencies across mailbox archives.
Supported email formats for parsing metadata and extracting investigation evidence include PST, OST, MBOX, EML, and MSG. Robust parsing handles individual messages, full mailboxes, and archives to identify forensic artifacts.
SherifEldeebParse email mailboxes and extract messages, headers, and artifacts for forensic investigations.
jassicsExtract and validate atomic, computed, and behavioral indicators from incident data.
workromancerFetch web URLs and extract all text content.
YukiIto1999Detect adversary activity in PCAPs, Zeek logs, and IDS alerts.
