forensic-analysis

name

forensic-analysis

description

Digital forensic analysis skill for investigating disk images, memory dumps, PCAPs, malware, and system artifacts. Use this skill whenever the user needs to perform forensic analysis on any digital evidence including disk images, memory dumps, network captures, suspicious files, or when investigating security incidents. Trigger this skill for any forensic investigation, incident response, malware analysis, or digital evidence examination tasks.

Digital Forensic Analysis

A comprehensive skill for performing digital forensic investigations across multiple evidence types and platforms.

When to Use This Skill

Use this skill when you need to:

• Analyze disk images or file system artifacts
• Investigate memory dumps for malicious activity
• Examine network captures (PCAP files)
• Perform malware analysis on suspicious files
• Conduct incident response investigations
• Recover deleted or hidden files
• Analyze browser artifacts and user activity
• Detect anti-forensic techniques
• Perform threat hunting and file integrity monitoring

Forensic Investigation Workflow

Follow this systematic approach for forensic investigations:

1. Evidence Acquisition and Preservation

Before analysis begins:

• Create forensic copies (never work on original evidence)
• Calculate and document hash values (MD5, SHA1, SHA256)
• Maintain chain of custody documentation
• Use write-blockers when acquiring disk images

Image acquisition commands:

# Create forensic image with dd
dd if=/dev/sdX of=image.img bs=4M status=progress

# Verify image integrity
 image.img
 image.img


 =/dev/sdX of=image.sparse.img bs=4M conv=sparse