forensics

Analyze disk images, memory dumps, and packet captures for incident response.

Updated Jul 1, 2026

Search Tags:#artifact analysis #timeline analysis #memory forensics #digital forensics #network forensics

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill forensics-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: forensics
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/forensics
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill forensics-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires plaso, volatility3, tshark, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill enables a comprehensive digital forensics analysis by providing methodologies for disk, memory, and network analysis, assisting in compromised system investigation or incident response.

Core Features & Use Cases

Artifact Analysis: Analyze raw disk images, memory dumps, packet captures, and registry artifacts.
Timeline Analysis: Conduct timeline analysis for file modification events.
File Carving: Retrieve files from disk images without metadata.
Memory and Network Analysis: Examine system memory and network traffic to uncover suspicious activity.
IOC Extraction: Extract IOCs from data, such as IPs, domains, and hashes.
Use Case: Ideal for security analysts needing to investigate a breach by providing in-depth analysis capabilities.

Quick Start

To start the forensics analysis on 'evidence.dd', execute the 'digital-forensics analyze' command.

Frequently Asked Questions about forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform memory forensics on a memory dump?▼

Memory forensics on a memory dump uses Volatility 3 to examine system memory and uncover suspicious activity. This Skill automates memory profiling to extract running processes and artifacts for incident response and post-mortem analysis.

Can I conduct timeline analysis on raw disk images?▼

Timeline analysis can be conducted on raw disk images using Plaso to reconstruct file modification events. This Skill leverages Plaso to build a chronological timeline of system activity for post-mortem investigation.

What is the best way to analyze packet captures for incident response?▼

Analyzing packet captures for incident response is best done using tshark for network traffic inspection. This Skill uses tshark to examine packet captures, extract IOCs like IPs and domains, and identify suspicious network communications.

Does this digital forensics workflow support file carving without metadata?▼

This digital forensics workflow supports file carving to retrieve files from disk images without metadata. It extracts files directly from raw disk images, assisting in compromised system investigation when standard file system structures are damaged.

Do I need specific tools installed to extract IOCs from disk images?▼

You need Plaso, Volatility 3, and tshark installed to extract IOCs such as IPs, domains, and hashes. These dependencies are required for the Skill to perform full artifact, memory, and network forensics analysis.