performing-disk-forensics-investigation
CommunityAutomate disk forensics from image to timeline.
Data & Analytics#timeline-reconstruction#evidence-management#disk-forensics#forensic-imaging#file-system-analysis#artifact-recovery
AuthorYukiIto1999
Version1.0.0
Installs0
System Documentation
What problem does it solve?
Disk-based investigations require imaging, file-system parsing, artifact recovery, and timeline reconstruction to establish a solid evidentiary basis and support incident response.
Core Features & Use Cases
- End-to-end disk forensics workflow: imaging, integrity verification, file-system analysis, and artifact recovery.
- Timeline reconstruction: build a sequence of events from MFT/inode data, logs, and artifact traces.
- Evidence documentation: generates reports and structured outputs suitable for legal and HR investigations.
Quick Start
Run the disk forensics workflow against a disk image to produce an integrity-verified report and incident timeline.
Dependency Matrix
Required Modules
pytsk3
Components
scriptsreferences
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: performing-disk-forensics-investigation Download link: https://github.com/YukiIto1999/ctf-sleuth/archive/main.zip#performing-disk-forensics-investigation Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.