Agent skill
digital-forensics
Digital forensics analysis and investigation tools for system security audits, file analysis, and evidence preservation
Install this agent skill to your Project
npx add-skill https://github.com/ljchg12-hue/dotfiles/tree/main/skills/digital-forensics
SKILL.md
Digital Forensics Skill
Digital forensics toolkit for analyzing systems, files, and artifacts.
When to Use
- Forensic analysis of files or systems
- Security incident investigation
- Evidence preservation, file integrity verification
- Keywords: "forensics", "investigation", "evidence", "audit"
Core Capabilities
1. File System Analysis
- Directory structure, file access timeline
- Deleted file recovery traces
- Hidden file detection
2. Hash Verification
- MD5, SHA1, SHA256, SHA512 checksums
- File integrity verification
- Chain of custody documentation
3. Timeline Reconstruction
- Event timeline generation
- File operation sequences
- User activity patterns
4. Evidence Preservation
- Write-blocking recommendations
- Hash-based verification
- Chain of custody tracking
Quick Reference
Commands
# File metadata
stat <file>
file <file>
exiftool <file>
# File hashing
md5sum <file>
shasum -a 256 <file>
# Timeline analysis
find /path -type f -printf '%T@ %Tc %p\n' | sort -n
find /path -mtime -7 -type f
# Deleted file recovery
photorec /d /path/to/output /path/to/device
testdisk
Workflow
- Initial Assessment: Document state, calculate baseline hashes
- Data Collection: Extract metadata, generate file listings
- Analysis: Timeline reconstruction, pattern identification
- Reporting: Evidence documentation, findings summary
Best Practices
- ✅ Always work on copies, never originals
- ✅ Document every step
- ✅ Maintain chain of custody
- ✅ Hash verify all evidence
- ❌ Never modify original evidence
- ❌ Don't skip documentation
Use Cases
- Security Incident: Baseline → Recent modifications → Login history → Timeline
- File Integrity: Calculate hashes → Compare baseline → Document results
- Data Recovery: Analyze journal → Check fragments → Assess recovery
Output Format
- Executive Summary: High-level findings
- Timeline: Chronological events
- Evidence List: All artifacts
- Hash Values: Examined files
- Recommendations: Next steps
Limitations
- Cannot recover physically overwritten data
- Encrypted data requires keys
- Anti-forensics may hide evidence
Integration
- metadata-extraction: File metadata analysis
- threat-hunting: Timeline reconstruction
- file-organization: Evidence preservation
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
ljchg12-hue/dotfiles
random-selection
Randomly select items from lists using various algorithms for fair and unbiased selection
ljchg12-hue/dotfiles
threat-hunting
Proactive threat detection using Sigma rules, IOCs, and behavioral analytics
ljchg12-hue/dotfiles
auth-implementation-patterns
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
ljchg12-hue/dotfiles
debugging-strategies
Master systematic debugging techniques, profiling tools, and root cause analysis to efficiently track down bugs across any codebase or technology stack. Use when investigating bugs, performance issues, or unexpected behavior.
ljchg12-hue/dotfiles
sql-optimization-patterns
Master SQL query optimization, indexing strategies, and EXPLAIN analysis to dramatically improve database performance and eliminate slow queries. Use when debugging slow queries, designing database schemas, or optimizing application performance.
ljchg12-hue/dotfiles
monorepo-management
Master monorepo management with Turborepo, Nx, and pnpm workspaces to build efficient, scalable multi-package repositories with optimized builds and dependency management. Use when setting up monorepos, optimizing builds, or managing shared dependencies.
Didn't find tool you were looking for?