forensics-tools

Identify and extract forensic signals from files, network traces, and memory dumps.

6|Updated Feb 5, 2026
One-click install
npx skills add https://github.com/G36maid/ctf-arsenal --skill forensics-tools
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: forensics-tools
Source: https://github.com/G36maid/ctf-arsenal/tree/main/.agents/skills/forensics-tools
Command: npx skills add https://github.com/G36maid/ctf-arsenal --skill forensics-tools

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Digital forensics often requires juggling scattered tools and manual workflows. This skill consolidates file carving, steganography detection, PCAP analysis, entropy scanning, and memory forensics into a cohesive offline toolkit to accelerate investigations in CTF challenges and real-world incidents.

Core Features & Use Cases

  • File Analysis & Carving: Inspect files for signatures, carve embedded content, and recover artifacts.
  • Steganography Detection: Detect hidden data in images and other media, and recover embedded payloads.
  • Network Forensics: Analyze PCAPs, extract HTTP/DNS data, and reconstruct streams.
  • Entropy & Metadata: Assess data entropy and metadata to identify encrypted or compressed payloads.
  • Use Case: Quickly triage a suspicious ZIP or memory dump to surface flags or evidence for reporting.

Quick Start

Load this skill and run the included forensic workflows to triage a suspicious file, PCAP, or memory dump offline.

Frequently Asked Questions about forensics-tools

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract hidden flags from a suspicious file or memory dump in a CTF?

To analyze a PCAP file for forensic artifacts, load this skill to extract HTTP and DNS data, assess payload entropy, and reconstruct network streams. It consolidates network forensics into a cohesive offline workflow for CTF challenges.

What is the best way to detect steganography in images offline?

Detecting steganography offline involves scanning images and media to identify hidden data and recover embedded payloads. This skill provides structured steganography detection workflows to surface concealed evidence without requiring internet connectivity.

Can I perform memory forensics and file carving completely offline?

Yes, you can perform memory forensics and file carving completely offline. This skill provides offline tools to inspect file signatures, carve embedded content from memory dumps, and recover artifacts for CTF challenges and incident investigations.

Does this digital forensics toolkit require any external dependencies?

This digital forensics toolkit requires no external dependencies to function. It consolidates file carving, steganography detection, and PCAP analysis into an offline toolkit, making it suitable for isolated investigation environments.