forensics

Reconstruct digital forensics timelines and extract Indicators of Compromise.

3|3|Updated Mar 8, 2026

Search Tags:#incident response #timeline reconstruction #forensics #ioc #chain of custody #digital evidence

Ready to run

npx skills add https://github.com/jaskaranhundal/usap-skills --skill forensics-jaskaranhundal

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: forensics
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/response/forensics
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill forensics-jaskaranhundal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires avml, ps, ss, awscli, ftk-imager, volatility, lecmd, hayabusa, kape, velociraptor, magnet-axiom, zeek, netflow, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill reconstructs digital timelines, identifies evidence, and guides preservation for security incidents, ensuring legally defensible investigations.

Core Features & Use Cases

Timeline Reconstruction: Creates a chronological sequence of events from various digital artifacts.
Evidence Preservation: Provides guidance on collecting and preserving digital evidence with chain-of-custody.
IOC Extraction: Identifies Indicators of Compromise (IPs, domains, hashes) related to the incident.
Use Case: After a confirmed breach, use this Skill to analyze logs and memory dumps to determine the initial entry point, attacker actions, and data exfiltration, producing a detailed report for legal and incident response teams.

Quick Start

Analyze the provided incident details to reconstruct the attacker's timeline and identify key forensic artifacts.

Frequently Asked Questions about forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reconstruct an incident timeline from memory dumps and logs after a breach?▼

Incident timeline reconstruction analyzes memory dumps and logs using frameworks like DFRWS to chronologically sequence attacker actions. This process identifies the initial entry point and exfiltration events, producing detailed reports for incident response teams.

What is the proper chain of custody process for preserving digital evidence?▼

Chain of custody for digital evidence requires specific forensic methodologies to collect and preserve artifacts legally defensibly. It ensures that disk, memory, network, and cloud forensic data remains untampered for investigative and legal review.

Can I extract Indicators of Compromise from disk and cloud forensics artifacts?▼

Indicators of Compromise (IOC) extraction identifies malicious IPs, domains, and hashes across disk, memory, network, and cloud forensics. Analyzing these artifacts reveals compromised entities and attacker infrastructure tied to the incident.

Does this digital forensics approach support Volatility and AVML for memory analysis?▼

Digital forensics memory analysis supports tools like Volatility for standard memory dumps and AVML for Linux memory acquisition. These dependencies enable deep inspection of running processes and malware artifacts during incident response.

What is the best way to analyze network artifacts using Zeek and Netflow during an incident?▼

Network artifact analysis using Zeek and Netflow captures traffic metadata to identify data exfiltration and lateral movement. This network forensics approach reconstructs attacker communication paths outside the compromised host.

When should I use KAPE and Velociraptor over FTK Imager for evidence collection?▼

KAPE and Velociraptor excel at rapid live response and targeted artifact collection across multiple endpoints, while FTK Imager is suited for comprehensive forensic disk imaging. Choosing depends on whether rapid triage or full preservation is needed.