← LeaderboardThe Skill Leaderboard

digital-forensics

Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation.

Published by sickn33 ↗sickn33/agentic-awesome-skills

Try your first task

digital-forensics

Start a fresh conversation. Replace the highlighted placeholders.

Use digital-forensics to triage the authorized Windows memory-dump working copy [working-copy path and SHA256], using the available compatible Volatility installation, and deliver a reproducible, timestamped evidence table/timeline with artifact references and tentative, sensitivity-minimized IOCs. Record timezone and acquisition details, verify chain of custody and the working-copy hash, preserve the original read-only, and report unavailable commands or inconclusive evidence without fabricating results; do not acquire systems, extract credentials, run artifacts, or perform C2/malware analysis.

Required inputs

  • [working-copy path and SHA256]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: digital-forensicsdescription: "Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation."risk: safesource: "https://github.com/zhaoxuya520/reverse-skill"source_repo: "zhaoxuya520/reverse-skill"source_type: communitydate_added: "2026-08-25"license: "MIT"license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"

Digital Forensics & IR Artifacts

When to Use

  • Investigating a suspected incident with forensic rigor.
  • Building defensible timelines from disk/memory/network artifacts.

适用场景

  • 内存转储分析（Volatility 2/3）
  • 磁盘/ E01 / 落地文件时间线
  • PCAP 溯源与协议还原（可联合 protocol-reverse/）
  • 主机伪影：Prefetch、Shimcache、Event Log、浏览器历史
  • 应急响应 IOC 提炼（联合 malware-analysis/ / threat-hunting/）

工作流

1. 保全

□ 计算 SHA256；记录时区与采集命令
□ 工作在副本上；原始只读
□ chain of custody 备注写入 timeline

2. 内存

vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline

3. 主机伪影

□ 事件日志：Security / PowerShell / Sysmon
□ 持久化：Run 键、服务、计划任务、WMI
□ 执行痕迹：Amcache、Prefetch、BAM

4. 网络

□ tshark 统计会话与 DNS
□ 导出可疑流 → protocol-reverse 或 malware C2 分析

工具链

工具用途
Volatility 3内存
Timeline Explorer / Plaso超级时间线
tsharkPCAP
Eric Zimmerman 工具集Windows 伪影
Autopsy / FTK Imager磁盘

参考

  • references/forensics-triage.md
  • ../malware-analysis/ ../threat-hunting/ ../protocol-reverse/

路由上下文

上游: MASTER R25
下游: 恶意样本深挖 → malware-analysis；规则 → threat-hunting

任务完成自检

  • 是否保全哈希与副本策略？
  • 时间线是否可复核？
  • IOC 是否脱敏分级？
  • Checklist？

Limitations

  • Chain-of-custody requirements apply; work on verified copies, never originals.
  • Encrypted or anti-forensic artifacts may be unrecoverable.

Adapted from zhaoxuya520/reverse-skill (MIT).