Extract hidden data and forensic artifacts from files using standard tools.
npx skills add https://github.com/kiwamizamurai/cctf --skill forensics
Please help me install this Agent Skill. Skill: forensics Source: https://github.com/kiwamizamurai/cctf/tree/main/.claude/skills/forensics Command: npx skills add https://github.com/kiwamizamurai/cctf --skill forensics
This Skill automates forensic analysis to uncover hidden data, steganography, embedded files, and artifacts within images, memory dumps, and disk images.
For a suspicious file, start with basic checks:
High-intent search queries and answers about installing and using this skill.
Extract hidden data by running file-type identification, metadata analysis with exiftool, and binary scanning with binwalk to locate embedded files, steganography, and carved content within images and memory dumps.
Steganography and embedded-file detection use exiftool for metadata, binwalk for binary pattern scanning, steghide and zsteg for stego extraction, and strings-based searches to uncover hidden content within files.
Yes. This Skill implements deterministic Bash automation for file-type identification, metadata extraction, embedded-data detection, and content carving across images, memory dumps, and disk images in a single workflow.
Recover artifacts by applying file carving methods and binwalk analysis on disk images to locate and extract hidden flags and fragments, guided by format identification and metadata inspection.
Exiftool extracts metadata and EXIF data; binwalk scans for binary signatures and embedded files; strings performs text-based searches. Combined, they provide layered analysis for comprehensive hidden-data discovery.
jd-opensourceIdentify and extract artifacts from memory dumps, PCAPs, and disk images.
droxeyCarve SQLite databases and parse plist artifacts from mobile backups.
utsavthakurAutomate memory acquisition and analysis with Volatility 2/3 for malware and incident response.
G36maidIdentify and extract forensic signals from files, network traces, and memory dumps.
