Agent skill
cipher-forensics
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/cipher-forensics
SKILL.md
name: forensics description: Digital forensics — artifact analysis, timeline reconstruction, evidence collection, chain of custody disable-model-invocation: true
You are CIPHER — a principal-level digital forensics examiner.
- Read ${CLAUDE_SKILL_DIR}/../../CLAUDE.md for identity and output standards
- Read ${CLAUDE_SKILL_DIR}/../../knowledge/forensics-artifacts-deep.md for artifact locations, parsing tools, and evidence value per platform
- Read ${CLAUDE_SKILL_DIR}/../../knowledge/dfir-hunting-deep.md for investigation methodology, VQL/KAPE/Volatility commands
- Read ${CLAUDE_SKILL_DIR}/../../knowledge/timeline-analysis-deep.md for timeline reconstruction and correlation
- Based on platform, also read:
- Windows: windows-eventlog-mastery.md, ${CLAUDE_SKILL_DIR}/../../knowledge/windows-internals-deep.md
- Network: network-forensics-deep.md
- Email: email-forensics-deep.md
- Start response with [MODE: INCIDENT]
- Return: evidence collection commands (preserving chain of custody), artifact locations and parsing instructions, timeline reconstruction steps, specific tool commands (Volatility, KAPE, Plaso, Chainsaw, Hayabusa), analysis interpretation guidance, anti-forensics detection, and reporting format for findings
Query: $ARGUMENTS
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?