digital-forensics – Security skill for AI agents

Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation.

SecuritySKILL.mdClaude Code · Codex · Hermes · DeepSeek

Install the digital-forensics skill with one command

Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.

Claude Code

mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/digital-forensics-8c991.tgz | tar xz -C ~/.claude/skills

Call it in Claude Code: /digital-forensics – then describe the task you want done.

Codex

mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/digital-forensics-8c991.tgz | tar xz -C ~/.codex/skills

Call it in Codex: $digital-forensics – then describe the task you want done.

Hermes Agent

mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/digital-forensics-8c991.tgz | tar xz -C ~/.hermes/skills

Call it in Hermes Agent: /digital-forensics – then describe the task you want done.

DeepSeek

mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/digital-forensics-8c991.tgz | tar xz -C ~/.deepcode/skills

Call it in DeepSeek: /digital-forensics – then describe the task you want done.

SKILL.md content

Digital Forensics & IR Artifacts

When to Use

Investigating a suspected incident with forensic rigor.
Building defensible timelines from disk/memory/network artifacts.

适用场景

内存转储分析（Volatility 2/3）
磁盘/ E01 / 落地文件时间线
PCAP 溯源与协议还原（可联合 protocol-reverse/）
主机伪影：Prefetch、Shimcache、Event Log、浏览器历史
应急响应 IOC 提炼（联合 malware-analysis/ / threat-hunting/）

工作流

1. 保全

□ 计算 SHA256；记录时区与采集命令
□ 工作在副本上；原始只读
□ chain of custody 备注写入 timeline

2. 内存

vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline

3. 主机伪影

□ 事件日志：Security / PowerShell / Sysmon
□ 持久化：Run 键、服务、计划任务、WMI
□ 执行痕迹：Amcache、Prefetch、BAM

4. 网络

□ tshark 统计会话与 DNS
□ 导出可疑流 → protocol-reverse 或 malware C2 分析

工具链

| 工具 | 用途 |

|------|------|

| Volatility 3 | 内存 |

| Timeline Explorer / Plaso | 超级时间线 |

| tshark | PCAP |

| Eric Zimmerman 工具集 | Windows 伪影 |

| Autopsy / FTK Imager | 磁盘 |

参考

references/forensics-triage.md
../malware-analysis/ ../threat-hunting/ ../protocol-reverse/

路由上下文

上游: MASTER R25

下游: 恶意样本深挖 → malware-analysis；规则 → threat-hunting

任务完成自检

[ ] 是否保全哈希与副本策略？
[ ] 时间线是否可复核？
[ ] IOC 是否脱敏分级？
[ ] Checklist？

Limitations

Chain-of-custody requirements apply; work on verified copies, never originals.
Encrypted or anti-forensic artifacts may be unrecoverable.

> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).

Related skills

wp-plugin-cve-hunt – Systematic approach to finding and testing CVEs for identified WordPress plugins. Covers…
wstg-web-pentest – Full WSTG-aligned web application pentest — 12-phase methodology from information…
procurement-optimizer – Use when running an annual SaaS audit, doing category-level spend review, or…
xmlrpc-exploitation – Exploit XMLRPC multicall, pingback for brute force and SSRF.
zimbra-attack – Zimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.
threat-mitigation-mapping – Map identified threats to appropriate security controls and mitigations. Use when…
qms-audit-expert – ISO 13485 internal audit expertise for medical device QMS. Covers audit planning…
red-team – Use when planning or executing authorized red team engagements, attack path analysis, or…

← Browse all skills