New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Disk Forensics

by briiirussell in briiirussell/cybersecurity-skills

Analyze disk images, file systems, and memory captures for digital evidence recovery in forensic investigations and CTF challenges.

MITAuto-check: notesSecurity

Install Disk Forensics

skills CLI
$ npx skills add briiirussell/cybersecurity-skills --skill disk-forensics -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install briiirussell/cybersecurity-skills disk-forensics --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/briiirussell/cybersecurity-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/disk-forensics .claude/skills/disk-forensics && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
disk-forensics
GitHub stars
413
Token cost
~1.5k tokens
SKILL.md length
492 words
Files
1
Skills in repo
25
Repo updated
First seen
Licence
MIT

At a glance

Analyze disk images, file systems, and memory captures for digital evidence recovery in forensic investigations and CTF challenges.

  • Works in 8 steps: Image Identification and Integrity → Partition Layout → Mount and Explore → …
  • The user mentions disk forensics
  • SKILL.md covers Authorization Check, Evidence Handling Principles, Methodology and Output Format, plus 2 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Disk Forensics is an agent skill from briiirussell/cybersecurity-skills. Analyze disk images, file systems, and memory captures for digital evidence recovery in forensic investigations and CTF challenges. Use when the user mentions 'disk forensics,' 'forensic analysis,' 'disk image,' 'file carving,' 'deleted files,' 'evidence recovery,' 'timeline analysis,' 'memory forensics,' 'volatility,' 'autopsy,' 'sleuthkit,' 'plaso,' 'log2timeline,' 'artifact analysis,' 'chain of custody,' or needs to examine a forensic image.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Digital forensics. The repository describes itself as: Cybersecurity skills for AI coding agents (Claude Code, Cursor, Codex). The licence is MIT.

When your agent uses it

  • The user mentions disk forensics
  • Forensic analysis
  • Evidence recovery
  • Timeline analysis

Example prompts

  • “disk forensics,”
  • “forensic analysis,”
  • “disk image,”
  • “/disk-forensics”

Requirements

  • Pre-approved tools (allowed-tools): Bash, Read, Write, Grep, Glob

Workflow steps

8 steps, taken from the step headings in SKILL.md.

  1. Image Identification and Integrity
  2. Partition Layout
  3. Mount and Explore
  4. File System Analysis (Sleuth Kit)
  5. Artifact Recovery
  6. Metadata and Timestamps
  7. Keyword Search
  8. Timeline Construction

What it can do on your machine

Read from SKILL.md and the folder at commit c9ade03. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Bash
    • Read
    • Write
    • Grep
    • Glob

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are bash and markdown).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Disk Forensics loads about 1.5k tokens when it runs. Until then it costs about 116 tokens; SKILL.md has 492 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~116
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Bash, Read, Write, Grep, Glob

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from briiirussell/cybersecurity-skills at commit c9ade03, republished under its MIT licence (© briiirussell). 492 words, ~1,468 tokens.

Download SKILL.mdSave it as .claude/skills/disk-forensics/SKILL.md (or your agent's skills folder).
name
disk-forensics
description
Analyze disk images, file systems, and memory captures for digital evidence recovery in forensic investigations and CTF challenges. Use when the user mentions 'disk forensics,' 'forensic analysis,' 'disk image,' 'file carving,' 'deleted files,' 'evidence recovery,' 'timeline analysis,' 'memory forensics,' 'volatility,' 'autopsy,' 'sleuthkit,' 'plaso,' 'log2timeline,' 'artifact analysis,' 'chain of custody,' or needs to examine a forensic image.
allowed-tools
Bash, Read, Write, Grep, Glob

Disk Forensics — Digital Evidence Analysis

Analyze disk images and file systems to recover evidence, reconstruct timelines, and identify artifacts.

Cross-references: incident-triage for the upstream containment phase that captures the image this skill analyzes — that skill makes the bit-for-bit copy; this skill analyzes it. breach-patterns for translating the forensic findings into preemptive controls so the same root cause doesn't recur.

Authorization Check

Before analyzing any image, confirm:

  1. Lawful basis — the user has authorization for this analysis (internal investigation with documented scope, court-ordered work, signed IR engagement, your own system, CTF / lab environment)
  2. Chain of custody is preserved — the image and its hashes were captured in a way that survives evidentiary scrutiny, OR the scope is explicitly non-evidentiary (CTF, internal triage where chain-of-custody is not the goal)
  3. Privacy scope — the analysis stays within what was authorized; personal data outside the scope is not pulled, analyzed, or reported

If lawful basis is unclear, ask before proceeding. Never analyze an image you cannot confirm the user is authorized to possess.

Evidence Handling Principles

  • Always work on copies, never originals
  • Verify image integrity with hash comparison before analysis
  • Mount everything read-only
  • Document every command and finding
  • Preserve timestamps — never modify source evidence

Methodology

Step 1: Image Identification and Integrity

Identify the image format and verify integrity:

bash
file <image>                    # Identify format (E01, dd/raw, VMDK, VHD)
sha256sum <image>               # Compare to provided hash

For E01 images, use ewfinfo to extract metadata.

Step 2: Partition Layout

Examine the partition structure:

bash
fdisk -l <image>                # Partition table
mmls <image>                    # Sleuth Kit partition layout

Calculate mount offsets: sector_start × sector_size

Step 3: Mount and Explore

Mount read-only and survey the file system:

bash
mount -o ro,loop,offset=<bytes> <image> /mnt/evidence
ls -laR /mnt/evidence

For encrypted volumes, identify the encryption type and request the key/passphrase.

Step 4: File System Analysis (Sleuth Kit)
bash
fsstat -o <offset> <image>              # File system details
fls -r -o <offset> <image>             # Full file listing (deleted files marked with *)
icat -o <offset> <image> <inode>       # Extract specific file by inode
Show full SKILL.md (227 more words)Show less
Step 5: Artifact Recovery

Deleted files: Use fls to find (marked with *), icat to extract by inode.

File carving: Run foremost or scalpel on unallocated space to recover files by header signatures.

Hidden data:

  • NTFS alternate data streams
  • HFS+ resource forks
  • Check image files for steganography: exiftool, binwalk, steghide

System artifacts:

  • Browser history: ~/.mozilla, ~/Library/Safari, AppData\Local\Google
  • System logs: /var/log/*, Windows Event Logs
  • Registry hives (Windows): SAM, SYSTEM, SOFTWARE, NTUSER.DAT
  • Recently accessed files, USB device history, prefetch files
Step 6: Metadata and Timestamps
bash
exiftool <file>                 # EXIF, XMP, IPTC metadata
stat <file>                     # MAC times (Modified, Accessed, Changed)

For NTFS: examine $MFT timestamps and $UsnJrnl for change journal entries.

Use mactime (Sleuth Kit) to generate a unified timeline from body files.

bash
strings <image> | grep -i <keyword>    # Raw string search across image

Use bulk_extractor for automated extraction of emails, URLs, credit card numbers, and other structured data.

Step 8: Timeline Construction

Collect all timestamps into a unified timeline. Cross-reference file events with log entries. Flag anomalies:

  • Timestamps before the OS install date
  • Future-dated files
  • Gaps in otherwise continuous log sequences
  • Timestamps inconsistent with timezone settings

Output Format

markdown
# Forensic Analysis Report
## Case: [identifier]
## Image: [filename] — SHA256: [hash]
## Date of Analysis: [date]

### Image Integrity
- Hash verified: [yes/no]
- Algorithm: [SHA256]

### Partition Layout
| # | Type | Start | Size | File System |
|---|------|-------|------|-------------|

### Key Findings
#### Finding 1: [Title]
- **Evidence:** [file path or artifact]
- **Content:** [description]
- **Timestamp:** [UTC]
- **Significance:** [why this matters]

### Recovered Files
| File | Source | Recovery Method | SHA256 | Significance |
|------|--------|-----------------|--------|-------------|

### Timeline
| Timestamp (UTC) | Event | Source | Notes |
|-----------------|-------|--------|-------|

### Conclusions
[Summary of findings and their implications]

Boundaries

  • Work only on provided images and files
  • Maintain read-only access at all times
  • Document chain of custody for real investigations
  • For CTF challenges, focus on finding flags and solving the challenge
  • Never modify evidence or suggest evidence tampering
  • Refuse requests involving unauthorized device access

References

  • NIST SP 800-86: Guide to Integrating Forensic Techniques
  • The Sleuth Kit documentation
  • SANS Digital Forensics cheat sheets

© briiirussell, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/disk-forensics of briiirussell/cybersecurity-skills.

Open the folder on GitHubat commit c9ade03

Compare with similar skills

Disk Forensics next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Disk Forensics compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Disk Forensics this skillbriiirussell/cybersecurity-skills413—~1.5kAutomated safety check: NotesMIT
Campaign Attribution Evidence Analysismukul975/Anthropic-Cybersecurity-Skills34k—~2.3kAutomated safety check: PassApache-2.0
Oss ForensicsTommy-yw/RunbookHermes5463 repos~5kAutomated safety check: PassMIT
Ctf Malwareljagiello/ctf-skills3.4k—~2.1kAutomated safety check: NotesMIT
LNK and Jump List Forensicsmukul975/Anthropic-Cybersecurity-Skills34k—~2.8kAutomated safety check: PassApache-2.0
Malware Persistence Analysis with Autorunsmukul975/Anthropic-Cybersecurity-Skills34k—~1.2kAutomated safety check: PassApache-2.0

Similar skills

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Oss Forensics

    Tommy-yw/RunbookHermes

    Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories.

    546 GitHub starsUsed in 3 repos~5k tokens
    SecurityAuto-check passed

  • Ctf Malware

    ljagiello/ctf-skills

    Provides malware analysis and network traffic techniques for CTF challenges.

    3.4k GitHub stars~2.1k tokensUpdated 25 days ago
    SecurityAuto-check: notes

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Dfir

    transilienceai/communitytools

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

    562 GitHub stars~1.5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

More from briiirussell/cybersecurity-skills

All 25 skills in this repo

  • AI Risk Management

    briiirussell/cybersecurity-skills

    Apply the NIST AI Risk Management Framework (AI RMF 1.0) and adjacent guidance to AI / ML systems — model lifecycle governance, fairness and bias evaluation, robustness, transparency…

    413 GitHub stars~3.7k tokensUpdated 4 mo ago
    Auto-check: notes

  • API Audit

    briiirussell/cybersecurity-skills

    Audit REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023).

    413 GitHub stars~2.8k tokensUpdated 4 mo ago
    Auto-check: notes

  • Breach Patterns

    briiirussell/cybersecurity-skills

    Learn from public breach disclosures — extract the audit question each one implies and check your own stack.

    413 GitHub stars~3.5k tokensUpdated 4 mo ago
    Auto-check: notes

  • Cloud Audit

    briiirussell/cybersecurity-skills

    Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps.

    413 GitHub stars~1.3k tokensUpdated 4 mo ago
    Auto-check: notes

  • Container Audit

    briiirussell/cybersecurity-skills

    Audit container images, Dockerfiles, and Kubernetes manifests for misconfigurations, excessive privileges, exposed secrets, and runtime risks.

    413 GitHub stars~2.5k tokensUpdated 4 mo ago
    Auto-check: notes

  • Crypto Audit

    briiirussell/cybersecurity-skills

    Audit cryptography implementation — algorithm choice, key sizes, KDF parameters, IV/nonce handling, signature verification, randomness, TLS configuration, and key rotation.

    413 GitHub stars~2.8k tokensUpdated 4 mo ago
    Auto-check: notes

Categories

Questions about Disk Forensics

What does Disk Forensics do?

Analyze disk images, file systems, and memory captures for digital evidence recovery in forensic investigations and CTF challenges. Disk Forensics is an agent skill from briiirussell/cybersecurity-skills. Analyze disk images, file systems, and memory captures for digital evidence recovery in forensic investigations and CTF challenges.

When should I use Disk Forensics?

Disk Forensics fits situations like: the user mentions disk forensics; forensic analysis; evidence recovery; timeline analysis.

How do I install Disk Forensics in Claude Code?

Run `npx skills add briiirussell/cybersecurity-skills --skill disk-forensics -a claude-code`. Or copy the skill folder (skills/disk-forensics in briiirussell/cybersecurity-skills) into .claude/skills/disk-forensics in your project. Claude Code loads it when a task matches its description.

How do I install Disk Forensics in Codex?

Run `npx skills add briiirussell/cybersecurity-skills --skill disk-forensics -a codex`. Or copy the skill folder (skills/disk-forensics in briiirussell/cybersecurity-skills) into .agents/skills/disk-forensics in your project. Codex loads it when a task matches its description.

Can I use Disk Forensics in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add briiirussell/cybersecurity-skills --skill disk-forensics -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/disk-forensics, .gemini/skills/disk-forensics, .github/skills/disk-forensics and .opencode/skills/disk-forensics in your project.

What does Disk Forensics need to run?

SKILL.md names no scripts, command-line tools or credentials: Disk Forensics is instructions for the agent only. Its frontmatter pre-approves these tools: Bash, Read, Write, Grep, Glob.

Does Disk Forensics access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Disk Forensics safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Disk Forensics use?

Disk Forensics is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Disk Forensics use?

About 1.5k tokens (SKILL.md is roughly 5.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Disk Forensics?

Skills that share tags, products or a category with Disk Forensics: Campaign Attribution Evidence Analysis (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Oss Forensics (Tommy-yw/RunbookHermes, 546 stars), Ctf Malware (ljagiello/ctf-skills, 3.4k stars) and LNK and Jump List Forensics (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Disk Forensics?

briiirussell (a GitHub user) maintains it in briiirussell/cybersecurity-skills, which has 413 GitHub stars. The repository holds 25 skills in this directory. The repository was last updated on May 27, 2026.

Source: briiirussell/cybersecurity-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.