skills.rest
jmagly
jmaglyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

evidence-preservation

Implement RFC 3227 and NIST SP 800-86 evidence preservation procedures.

175|26|Updated Aug 14, 2025
Search Tags:#evidence#forensics#data preservation#digital forensics#chain of custody#rfc3227
One-click install
npx skills add https://github.com/jmagly/aiwg --skill evidence-preservation-jmagly
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: evidence-preservation
Source: https://github.com/jmagly/aiwg/tree/main/agentic/code/frameworks/forensics-complete/skills/evidence-preservation
Command: npx skills add https://github.com/jmagly/aiwg --skill evidence-preservation-jmagly

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill ensures that digital evidence is collected, documented, and preserved in a forensically sound manner, maintaining its integrity and admissibility in legal proceedings.

Core Features & Use Cases

  • Chain of Custody: Generates detailed logs tracking the handling and transfer of evidence.
  • Evidence Hashing: Creates cryptographic hashes (e.g., SHA256) to verify data integrity.
  • Volatile Data Collection: Guides the collection of time-sensitive data in the correct order.
  • Use Case: A security incident occurs, and you need to collect logs, running processes, and disk images from affected systems while ensuring every step is documented for potential legal review.

Quick Start

Begin the evidence preservation process by running the preserve evidence command.

Frequently Asked Questions about evidence-preservation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I preserve volatile data during a security incident?▼

Digital evidence preservation using cryptographic hashing creates SHA256 hashes to verify data integrity. This process ensures collected logs, disk images, and cloud artifacts remain unaltered and admissible for legal proceedings.

How do I document chain of custody for digital forensics?▼

Yes, cloud artifact acquisition and container forensics are supported. The Skill guides examiners through acquiring these modern digital artifacts alongside traditional log collection and disk imaging procedures.

What is the correct order for collecting digital evidence?▼

This Skill suits examiners needing forensically sound evidence collection aligned with NIST SP 800-86 and RFC 3227. It requires running the preserve evidence command to initiate automated log collection and hashing.

Does this approach support disk imaging and cloud artifact acquisition?▼

For potential legal review, you need chain of custody documentation and cryptographic hashing like SHA256. This ensures the integrity of collected logs, processes, and disk images throughout the evidence preservation process.

Related Skills

Explore More Legal & Compliance Skills→
do360nowdo360now

forensics-checklist

Automate digital forensic evidence collection and chain of custody documentation.

Community
Advanced
jaskaranhundaljaskaranhundal
3

forensics

Reconstruct digital forensics timelines and extract Indicators of Compromise.

Community
Advanced
aviskaaraviskaar
6

incident-responder

Execute incident response for security events with triage, containment, and forensic investigation.

Official
Advanced
as4584as4584
2

memory-forensics

Analyzes volatile memory dumps using Volatility 3 to extract processes, networks, and artifacts.

Community
Advanced