sickn33/agentic-awesome-skills/digital-forensics

Claude Code and agent skill by sickn33/agentic-awesome-skills

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation.

Install

npx vskill@latest install sickn33/agentic-awesome-skills/digital-forensics

SKILL.md

Digital Forensics & IR Artifacts

When to Use

  • Investigating a suspected incident with forensic rigor.
  • Building defensible timelines from disk/memory/network artifacts.

适用场景

  • 内存转储分析（Volatility 2/3）
  • 磁盘/ E01 / 落地文件时间线
  • PCAP 溯源与协议还原（可联合 protocol-reverse/）
  • 主机伪影：Prefetch、Shimcache、Event Log、浏览器历史
  • 应急响应 IOC 提炼（联合 malware-analysis/ / threat-hunting/）

工作流

1. 保全
text
□ 计算 SHA256；记录时区与采集命令
□ 工作在副本上；原始只读
□ chain of custody 备注写入 timeline
2. 内存
bash
vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline
3. 主机伪影
text
□ 事件日志：Security / PowerShell / Sysmon
□ 持久化：Run 键、服务、计划任务、WMI
□ 执行痕迹：Amcache、Prefetch、BAM
4. 网络
text
□ tshark 统计会话与 DNS
□ 导出可疑流 → protocol-reverse 或 malware C2 分析

工具链

工具用途
Volatility 3内存
Timeline Explorer / Plaso超级时间线
tsharkPCAP
Eric Zimmerman 工具集Windows 伪影
Autopsy / FTK Imager磁盘

参考

  • references/forensics-triage.md
  • ../malware-analysis/ ../threat-hunting/ ../protocol-reverse/

路由上下文

上游: MASTER R25 下游: 恶意样本深挖 → malware-analysis；规则 → threat-hunting

任务完成自检

  • [ ] 是否保全哈希与副本策略？
  • [ ] 时间线是否可复核？
  • [ ] IOC 是否脱敏分级？
  • [ ] Checklist？

Limitations

  • Chain-of-custody requirements apply; work on verified copies, never originals.
  • Encrypted or anti-forensic artifacts may be unrecoverable.
Adapted from zhaoxuya520/reverse-skill (MIT).

Security

  • Security scanPassed, 95 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

Repository stars
47,054
Repository forks
6,853
7-day trend score
54

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/sickn33/agentic-awesome-skills/digital-forensics/badge)](https://verified-skill.com/skills/sickn33/agentic-awesome-skills/digital-forensics)

Something wrong with this skill or its page? Tell us.