skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

forensic-chain-of-custody

Document forensic evidence provenance, handling, and analysis with hash verification.

Updated Jul 30, 2026
Search Tags:#security#audit#compliance#evidence#forensics#chain-of-custody
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill forensic-chain-of-custody
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: forensic-chain-of-custody
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/forensic-chain-of-custody
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill forensic-chain-of-custody

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the critical challenge of maintaining a legally defensible chain of custody for digital and physical evidence, preventing the loss of provenance or admissibility due to undocumented handling.

Core Features & Use Cases

  • Evidence Provenance Tracking: Records every transfer, hash verification, and analysis step with explicit gap-logging.
  • Integrity Verification: Automates the creation of hash manifests to detect tampering or storage corruption.
  • Use Case: During a forensic investigation, use this skill to document the intake of a disk image, log every analysis command executed, and generate a final, signed custody report for legal compliance.

Quick Start

Use the forensic-chain-of-custody skill to initialize a new case log and record the intake of the provided disk image evidence.

Frequently Asked Questions about forensic-chain-of-custody

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I maintain a legally defensible chain of custody for digital evidence during an incident response?▼

A chain of custody log documents the provenance, handling, and analysis of forensic evidence to ensure legal admissibility and integrity. It records every transfer, hash verification, and analysis step with explicit gap-logging for non-repudiation.

How do I track evidence provenance and verify integrity for a forensic investigation?▼

Track evidence provenance by recording every transfer and analysis step in a standardized custody timeline, while automating the creation of hash manifests to verify integrity and detect any tampering or storage corruption.

Can I use this to generate audit-ready custody reports for disk image intake?▼

Yes, you can initialize a new case log to record disk image intake, log every analysis command executed, and generate a final, signed custody report for legal compliance and audit readiness.

What is the best way to document custody timelines and prevent evidence inadmissibility?▼

The best way to prevent evidence inadmissibility is to maintain rigorous, audit-ready evidence logs that apply standardized reporting to custody timelines, ensuring strict audit trails and gap-logging during investigations.

When do I need explicit gap-logging in my evidence inventory management process?▼

You need explicit gap-logging in evidence inventory management whenever there is a transfer or waiting period in the custody timeline, preventing undocumented handling that could compromise non-repudiation and legal admissibility.

Related Skills

Explore More Legal & Compliance Skills→
FuzzdkkFuzzdkk
3

evidence-acquisition

Acquire and preserve digital evidence with hash verification and chain-of-custody logging.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

report-forensic

Compile forensic findings into a structured, legally defensible report.

Community
Advanced
jassicsjassics
6

forensic-triage

Automate forensic triage by collecting disk, memory, and log evidence to build an incident timeline.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

pentest-agent-evidence

Capture, redact, and organize security assessment evidence into audit-ready logs.

Community
Advanced