forensic-metadata

Extract and analyze file-system and embedded metadata from digital artifacts.

Updated Jul 30, 2026

Search Tags:#security #analysis #metadata #evidence #integrity #forensics

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill forensic-metadata

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: forensic-metadata
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/forensic-metadata
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill forensic-metadata

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the need for rigorous, non-destructive metadata analysis during security assessments, ensuring that evidence is handled with integrity while identifying potential tampering or anti-forensic indicators.

Core Features & Use Cases

Integrity Baseline: Automatically records file hashes, timestamps, and permissions to establish a chain-of-custody record.
Behavioral Timeline: Correlates metadata across multiple sources to detect anomalies, such as timestamp manipulation or file-type masking.
Use Case: During a forensic investigation, use this skill to extract EXIF data from images and document properties from files to identify potential evidence of tampering or unauthorized file modification.

Quick Start

Use the forensic-metadata skill to extract and analyze all metadata from the files located in the current evidence directory.

Frequently Asked Questions about forensic-metadata

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract and analyze file metadata for forensic investigations?▼

To extract and analyze file metadata for forensic investigations, this Skill non-destructively pulls embedded EXIF data, file-system timestamps, and hashes to establish an integrity baseline and reconstruct behavioral timelines.

Can I verify file integrity and detect timestamp manipulation during a security assessment?▼

You can verify file integrity by recording file hashes and permissions, and detect timestamp manipulation by cross-referencing metadata across sources to identify behavioral anomalies and anti-forensic indicators.

Does this metadata analysis approach work with standard forensic tools like exiftool or sleuthkit?▼

This metadata analysis approach integrates with standard forensic tools like exiftool or sleuthkit, requiring only read-only access to target files to safely extract evidence without altering the original artifacts.

What is the best way to preserve evidence and establish a chain of custody from digital artifacts?▼

The best way to preserve evidence and establish a chain of custody is to automatically record file hashes, timestamps, and permissions from digital artifacts through non-destructive metadata extraction.

How does cross-referencing file metadata help detect anti-forensic indicators?▼

Cross-referencing file metadata detects anti-forensic indicators by correlating timeline data across multiple sources to expose anomalies like file-type masking or unauthorized timestamp modifications.

Are there limitations when extracting embedded metadata from digital artifacts?▼

A key limitation is the strict requirement for read-only access to target files, meaning any source lacking accessible file-system or embedded metadata cannot be cross-referenced for tampering detection.