[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADMW2SC1XK0T91H0WJAHAD":3,"skill-same:01M6ADMW2SC1XK0T91H0WJAHAD":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6ADMW2SC1XK0T91H0WJAHAD","analyzing-disk-image-with-autopsy",null,"Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-disk-image-with-autopsy\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39],"image","analyzing disk image with autopsy","cybersecurity","artifacts","metadata","file","forensics","dd","autopsy","disk-analysis","sleuth-kit","file-recovery","artifact-analysis","2026-11-10 10:12:30",false,"---\nname: analyzing-disk-image-with-autopsy\ndescription: Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- autopsy\n- disk-analysis\n- sleuth-kit\n- file-recovery\n- artifact-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074.001\n- T1070.004\n- T1083\n---\n\n# Analyzing Disk Image with Autopsy\n\n## When to Use\n- When you have a forensic disk image and need structured analysis of its contents\n- During investigations requiring file recovery, keyword searching, and timeline analysis\n- When non-technical stakeholders need visual reports from forensic evidence\n- For examining file system metadata, deleted files, and embedded artifacts\n- When building a comprehensive case from multiple disk images\n\n## Prerequisites\n- Autopsy 4.x installed (Windows) or Autopsy 4.x with The Sleuth Kit (Linux)\n- Forensic disk image in raw (dd), E01 (EnCase), or AFF format\n- Minimum 8GB RAM (16GB recommended for large images)\n- Java Runtime Environment (JRE) 8+ for Autopsy\n- Sufficient disk space for the Autopsy case database (2-3x image size)\n- Hash databases (NSRL, known-bad hashes) for file identification\n\n## Workflow\n\n### Step 1: Install Autopsy and Configure Environment\n\n```bash\n# On Linux, install Sleuth Kit and Autopsy\nsudo apt-get install autopsy sleuthkit\n\n# Download Autopsy 4.x (GUI version) from official source\nwget https:\u002F\u002Fgithub.com\u002Fsleuthkit\u002Fautopsy\u002Freleases\u002Fdownload\u002Fautopsy-4.21.0\u002Fautopsy-4.21.0.zip\nunzip autopsy-4.21.0.zip -d \u002Fopt\u002Fautopsy\n\n# On Windows, run the MSI installer from sleuthkit.org\n# Launch Autopsy\n\u002Fopt\u002Fautopsy\u002Fbin\u002Fautopsy --nosplash\n\n# For Sleuth Kit command-line analysis alongside Autopsy\nsudo apt-get install sleuthkit\n```\n\n### Step 2: Create a New Case and Add the Disk Image\n\n```\n1. Launch Autopsy > \"New Case\"\n2. Enter Case Name: \"CASE-2024-001-Workstation\"\n3. Set Base Directory: \u002Fcases\u002Fcase-2024-001\u002Fautopsy\u002F\n4. Enter Case Number, Examiner Name\n5. Click \"Add Data Source\"\n6. Select \"Disk Image or VM File\"\n7. Browse to: \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n8. Select Time Zone of the original system\n9. Configure Ingest Modules (see Step 3)\n```\n\n```bash\n# Alternatively, use Sleuth Kit CLI to verify the image first\nimg_stat \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# List partitions in the image\nmmls \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Output example:\n# DOS Partition Table\n# Offset Sector: 0\n# Units are in 512-byte sectors\n#      Slot    Start        End          Length       Description\n#      00:  -----   0000000000   0000002047   0000002048   Primary Table (#0)\n#      01:  00:00   0000002048   0001026047   0001024000   NTFS (0x07)\n#      02:  00:01   0001026048   0976771071   0975745024   NTFS (0x07)\n\n# List files in a partition (offset 2048 sectors)\nfls -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n```\n\n### Step 3: Configure and Run Ingest Modules\n\n```\nEnable the following Autopsy Ingest Modules:\n- Recent Activity: Extracts browser history, downloads, cookies, bookmarks\n- Hash Lookup: Compares files against NSRL and known-bad hash sets\n- File Type Identification: Identifies files by signature, not extension\n- Keyword Search: Indexes content for full-text searching\n- Email Parser: Extracts emails from PST, MBOX, EML files\n- Extension Mismatch Detector: Finds files with wrong extensions\n- Exif Parser: Extracts metadata from images (GPS, camera, timestamps)\n- Encryption Detection: Identifies encrypted files and containers\n- Interesting Files Identifier: Flags files matching custom rule sets\n- Embedded File Extractor: Extracts files from ZIP, Office docs, PDFs\n- Picture Analyzer: Categorizes images using PhotoDNA or hash matching\n- Data Source Integrity: Verifies image hash during ingest\n```\n\n```bash\n# Configure NSRL hash set for known-good filtering\n# Download NSRL from https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fssd\u002Fsoftware-quality-group\u002Fnational-software-reference-library-nsrl\nwget https:\u002F\u002Fs3.amazonaws.com\u002Frds.nsrl.nist.gov\u002FRDS\u002Fcurrent\u002Frds_modernm.zip\nunzip rds_modernm.zip -d \u002Fopt\u002Fautopsy\u002Fhashsets\u002F\n\n# Import into Autopsy:\n# Tools > Options > Hash Sets > Import > Select NSRLFile.txt\n# Mark as \"Known\" (to filter out known-good files)\n```\n\n### Step 4: Analyze File System and Recover Deleted Files\n\n```bash\n# In Autopsy GUI: Navigate tree structure\n# - Data Sources > evidence.dd > vol2 (NTFS)\n# - Examine directory tree, note deleted files (marked with X)\n\n# Using Sleuth Kit CLI for targeted recovery\n# List deleted files\nfls -rd -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Recover a specific deleted file by inode\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 14523 > \u002Fcases\u002Fcase-2024-001\u002Frecovered\u002Fdeleted_document.docx\n\n# Extract all files from a directory\ntsk_recover -o 2048 -d \u002FUsers\u002Fsuspect\u002FDocuments \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   \u002Fcases\u002Fcase-2024-001\u002Frecovered\u002Fdocuments\u002F\n\n# Get detailed file metadata\nistat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 14523\n# Shows: creation, modification, access, MFT change timestamps, size, data runs\n```\n\n### Step 5: Perform Keyword Searches and Tag Evidence\n\n```\nIn Autopsy:\n1. Keyword Search panel > \"Ad Hoc Keyword Search\"\n2. Search terms: credit card patterns, SSN regex, email addresses\n3. Example regex for credit cards: \\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\\b\n4. Example regex for SSN: \\b\\d{3}-\\d{2}-\\d{4}\\b\n5. Review results > Right-click items > \"Add Tag\"\n6. Create tags: \"Evidence-Critical\", \"Evidence-Supporting\", \"Requires-Review\"\n7. Add comments to tagged items documenting relevance\n```\n\n```bash\n# Using Sleuth Kit for CLI keyword search\nsrch_strings -a -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | \\\n   grep -iE '(password|secret|confidential)' > \u002Fcases\u002Fcase-2024-001\u002Fkeyword_hits.txt\n\n# Search for specific file signatures\nsigfind -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 25504446\n# 25504446 = %PDF header signature\n```\n\n### Step 6: Build Timeline and Generate Reports\n\n```\nIn Autopsy:\n1. Timeline viewer: Tools > Timeline\n2. Select date range of interest (incident window)\n3. Filter by event type: File Created, Modified, Accessed, Web Activity\n4. Zoom into suspicious time periods\n5. Export timeline events as CSV for external analysis\n\nGenerate Report:\n1. Generate Report > HTML Report\n2. Select tagged items and data sources to include\n3. Configure report sections: file listings, keyword hits, timeline\n4. Export to \u002Fcases\u002Fcase-2024-001\u002Freports\u002F\n```\n\n```bash\n# Using Sleuth Kit mactime for CLI timeline\nfls -r -m \"\u002F\" -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd > \u002Fcases\u002Fcase-2024-001\u002Fbodyfile.txt\n\n# Generate timeline from bodyfile\nmactime -b \u002Fcases\u002Fcase-2024-001\u002Fbodyfile.txt -d > \u002Fcases\u002Fcase-2024-001\u002Ftimeline.csv\n\n# Filter timeline to specific date range\nmactime -b \u002Fcases\u002Fcase-2024-001\u002Fbodyfile.txt \\\n   -d 2024-01-15..2024-01-20 > \u002Fcases\u002Fcase-2024-001\u002Fincident_timeline.csv\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Ingest Modules | Automated analysis plugins that process data sources upon import |\n| MFT (Master File Table) | NTFS metadata structure recording all file entries and attributes |\n| File carving | Recovering files from unallocated space using file signatures |\n| Hash filtering | Using NSRL or custom hash sets to exclude known-good or flag known-bad files |\n| Timeline analysis | Chronological reconstruction of file system and user activity events |\n| Deleted file recovery | Restoring files whose directory entries are removed but data remains |\n| Keyword indexing | Full-text search index built from all file content including slack space |\n| Artifact extraction | Automated parsing of browser, email, registry, and OS-specific artifacts |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Autopsy | Open-source GUI forensic platform for disk image analysis |\n| The Sleuth Kit (TSK) | Command-line forensic toolkit underlying Autopsy |\n| fls | List files and directories in a disk image including deleted entries |\n| icat | Extract file content by inode number from a disk image |\n| mactime | Generate timeline from TSK bodyfile format |\n| mmls | Display partition layout of a disk image |\n| NSRL | NIST hash database for identifying known software files |\n| sigfind | Search for file signatures at the sector level |\n\n## Common Scenarios\n\n**Scenario 1: Employee Data Theft Investigation**\nImport the employee workstation image, run all ingest modules, search for company-confidential file names and keywords, examine USB connection artifacts in Recent Activity, check for cloud storage client artifacts, review deleted files for evidence of data staging, generate HTML report for legal team.\n\n**Scenario 2: Malware Infection Forensics**\nAdd the compromised system image, enable Extension Mismatch and Encryption Detection modules, examine the prefetch directory for execution evidence, search for known malware hashes, build timeline around the infection window, extract suspicious executables for further analysis in a sandbox.\n\n**Scenario 3: Child Exploitation Material (CSAM) Investigation**\nImport image with PhotoDNA and Project VIC hash sets enabled, run Picture Analyzer module, hash all image files against known-bad databases, tag and categorize matches by severity, generate law enforcement report with chain of custody documentation.\n\n**Scenario 4: Intellectual Property Dispute**\nImport multiple employee disk images as separate data sources in one case, perform keyword searches for proprietary terms and project names, compare file hashes between sources, build timeline showing file access and transfer patterns, export evidence for legal review.\n\n## Output Format\n\n```\nAutopsy Case Analysis Summary:\n  Case:           CASE-2024-001-Workstation\n  Image:          evidence.dd (500GB NTFS)\n  Partitions:     2 (System Reserved + Primary)\n  Total Files:    245,832\n  Deleted Files:  12,456 (recoverable: 8,234)\n\n  Ingest Results:\n    Hash Matches (Known Bad):  3 files\n    Extension Mismatches:      17 files\n    Keyword Hits:              234 across 45 files\n    Encrypted Files:           5 containers detected\n    EXIF Data Extracted:       1,245 images with metadata\n\n  Tagged Evidence:\n    Critical:     12 items\n    Supporting:   34 items\n    Review:       67 items\n\n  Timeline Events:  1,234,567 entries (filtered to incident window: 892)\n  Report:          \u002Fcases\u002Fcase-2024-001\u002Freports\u002Fautopsy_report.html\n```\n","# Analyzing Disk Image with Autopsy\n\n## When to Use\n- When you have a forensic disk image and need structured analysis of its contents\n- During investigations requiring file recovery, keyword searching, and timeline analysis\n- When non-technical stakeholders need visual reports from forensic evidence\n- For examining file system metadata, deleted files, and embedded artifacts\n- When building a comprehensive case from multiple disk images\n\n## Prerequisites\n- Autopsy 4.x installed (Windows) or Autopsy 4.x with The Sleuth Kit (Linux)\n- Forensic disk image in raw (dd), E01 (EnCase), or AFF format\n- Minimum 8GB RAM (16GB recommended for large images)\n- Java Runtime Environment (JRE) 8+ for Autopsy\n- Sufficient disk space for the Autopsy case database (2-3x image size)\n- Hash databases (NSRL, known-bad hashes) for file identification\n\n## Workflow\n\n### Step 1: Install Autopsy and Configure Environment\n\n```bash\n# On Linux, install Sleuth Kit and Autopsy\nsudo apt-get install autopsy sleuthkit\n\n# Download Autopsy 4.x (GUI version) from official source\nwget https:\u002F\u002Fgithub.com\u002Fsleuthkit\u002Fautopsy\u002Freleases\u002Fdownload\u002Fautopsy-4.21.0\u002Fautopsy-4.21.0.zip\nunzip autopsy-4.21.0.zip -d \u002Fopt\u002Fautopsy\n\n# On Windows, run the MSI installer from sleuthkit.org\n# Launch Autopsy\n\u002Fopt\u002Fautopsy\u002Fbin\u002Fautopsy --nosplash\n\n# For Sleuth Kit command-line analysis alongside Autopsy\nsudo apt-get install sleuthkit\n```\n\n### Step 2: Create a New Case and Add the Disk Image\n\n```\n1. Launch Autopsy > \"New Case\"\n2. Enter Case Name: \"CASE-2024-001-Workstation\"\n3. Set Base Directory: \u002Fcases\u002Fcase-2024-001\u002Fautopsy\u002F\n4. Enter Case Number, Examiner Name\n5. Click \"Add Data Source\"\n6. Select \"Disk Image or VM File\"\n7. Browse to: \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n8. Select Time Zone of the original system\n9. Configure Ingest Modules (see Step 3)\n```\n\n```bash\n# Alternatively, use Sleuth Kit CLI to verify the image first\nimg_stat \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# List partitions in the image\nmmls \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Output example:\n# DOS Partition Table\n# Offset Sector: 0\n# Units are in 512-byte sectors\n#      Slot    Start        End          Length       Description\n#      00:  -----   0000000000   0000002047   0000002048   Primary Table (#0)\n#      01:  00:00   0000002048   0001026047   0001024000   NTFS (0x07)\n#      02:  00:01   0001026048   0976771071   0975745024   NTFS (0x07)\n\n# List files in a partition (offset 2048 sectors)\nfls -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n```\n\n### Step 3: Configure and Run Ingest Modules\n\n```\nEnable the following Autopsy Ingest Modules:\n- Recent Activity: Extracts browser history, downloads, cookies, bookmarks\n- Hash Lookup: Compares files against NSRL and known-bad hash sets\n- File Type Identification: Identifies files by signature, not extension\n- Keyword Search: Indexes content for full-text searching\n- Email Parser: Extracts emails from PST, MBOX, EML files\n- Extension Mismatch Detector: Finds files with wrong extensions\n- Exif Parser: Extracts metadata from images (GPS, camera, timestamps)\n- Encryption Detection: Identifies encrypted files and containers\n- Interesting Files Identifier: Flags files matching custom rule sets\n- Embedded File Extractor: Extracts files from ZIP, Office docs, PDFs\n- Picture Analyzer: Categorizes images using PhotoDNA or hash matching\n- Data Source Integrity: Verifies image hash during ingest\n```\n\n```bash\n# Configure NSRL hash set for known-good filtering\n# Download NSRL from https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fssd\u002Fsoftware-quality-group\u002Fnational-software-reference-library-nsrl\nwget https:\u002F\u002Fs3.amazonaws.com\u002Frds.nsrl.nist.gov\u002FRDS\u002Fcurrent\u002Frds_modernm.zip\nunzip rds_modernm.zip -d \u002Fopt\u002Fautopsy\u002Fhashsets\u002F\n\n# Import into Autopsy:\n# Tools > Options > Hash Sets > Import > Select NSRLFile.txt\n# Mark as \"Known\" (to filter out known-good files)\n```\n\n### Step 4: Analyze File System and Recover Deleted Files\n\n```bash\n# In Autopsy GUI: Navigate tree structure\n# - Data Sources > evidence.dd > vol2 (NTFS)\n# - Examine directory tree, note deleted files (marked with X)\n\n# Using Sleuth Kit CLI for targeted recovery\n# List deleted files\nfls -rd -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Recover a specific deleted file by inode\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 14523 > \u002Fcases\u002Fcase-2024-001\u002Frecovered\u002Fdeleted_document.docx\n\n# Extract all files from a directory\ntsk_recover -o 2048 -d \u002FUsers\u002Fsuspect\u002FDocuments \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   \u002Fcases\u002Fcase-2024-001\u002Frecovered\u002Fdocuments\u002F\n\n# Get detailed file metadata\nistat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 14523\n# Shows: creation, modification, access, MFT change timestamps, size, data runs\n```\n\n### Step 5: Perform Keyword Searches and Tag Evidence\n\n```\nIn Autopsy:\n1. Keyword Search panel > \"Ad Hoc Keyword Search\"\n2. Search terms: credit card patterns, SSN regex, email addresses\n3. Example regex for credit cards: \\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\\b\n4. Example regex for SSN: \\b\\d{3}-\\d{2}-\\d{4}\\b\n5. Review results > Right-click items > \"Add Tag\"\n6. Create tags: \"Evidence-Critical\", \"Evidence-Supporting\", \"Requires-Review\"\n7. Add comments to tagged items documenting relevance\n```\n\n```bash\n# Using Sleuth Kit for CLI keyword search\nsrch_strings -a -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | \\\n   grep -iE '(password|secret|confidential)' > \u002Fcases\u002Fcase-2024-001\u002Fkeyword_hits.txt\n\n# Search for specific file signatures\nsigfind -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 25504446\n# 25504446 = %PDF header signature\n```\n\n### Step 6: Build Timeline and Generate Reports\n\n```\nIn Autopsy:\n1. Timeline viewer: Tools > Timeline\n2. Select date range of interest (incident window)\n3. Filter by event type: File Created, Modified, Accessed, Web Activity\n4. Zoom into suspicious time periods\n5. Export timeline events as CSV for external analysis\n\nGenerate Report:\n1. Generate Report > HTML Report\n2. Select tagged items and data sources to include\n3. Configure report sections: file listings, keyword hits, timeline\n4. Export to \u002Fcases\u002Fcase-2024-001\u002Freports\u002F\n```\n\n```bash\n# Using Sleuth Kit mactime for CLI timeline\nfls -r -m \"\u002F\" -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd > \u002Fcases\u002Fcase-2024-001\u002Fbodyfile.txt\n\n# Generate timeline from bodyfile\nmactime -b \u002Fcases\u002Fcase-2024-001\u002Fbodyfile.txt -d > \u002Fcases\u002Fcase-2024-001\u002Ftimeline.csv\n\n# Filter timeline to specific date range\nmactime -b \u002Fcases\u002Fcase-2024-001\u002Fbodyfile.txt \\\n   -d 2024-01-15..2024-01-20 > \u002Fcases\u002Fcase-2024-001\u002Fincident_timeline.csv\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Ingest Modules | Automated analysis plugins that process data sources upon import |\n| MFT (Master File Table) | NTFS metadata structure recording all file entries and attributes |\n| File carving | Recovering files from unallocated space using file signatures |\n| Hash filtering | Using NSRL or custom hash sets to exclude known-good or flag known-bad files |\n| Timeline analysis | Chronological reconstruction of file system and user activity events |\n| Deleted file recovery | Restoring files whose directory entries are removed but data remains |\n| Keyword indexing | Full-text search index built from all file content including slack space |\n| Artifact extraction | Automated parsing of browser, email, registry, and OS-specific artifacts |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Autopsy | Open-source GUI forensic platform for disk image analysis |\n| The Sleuth Kit (TSK) | Command-line forensic toolkit underlying Autopsy |\n| fls | List files and directories in a disk image including deleted entries |\n| icat | Extract file content by inode number from a disk image |\n| mactime | Generate timeline from TSK bodyfile format |\n| mmls | Display partition layout of a disk image |\n| NSRL | NIST hash database for identifying known software files |\n| sigfind | Search for file signatures at the sector level |\n\n## Common Scenarios\n\n**Scenario 1: Employee Data Theft Investigation**\nImport the employee workstation image, run all ingest modules, search for company-confidential file names and keywords, examine USB connection artifacts in Recent Activity, check for cloud storage client artifacts, review deleted files for evidence of data staging, generate HTML report for legal team.\n\n**Scenario 2: Malware Infection Forensics**\nAdd the compromised system image, enable Extension Mismatch and Encryption Detection modules, examine the prefetch directory for execution evidence, search for known malware hashes, build timeline around the infection window, extract suspicious executables for further analysis in a sandbox.\n\n**Scenario 3: Child Exploitation Material (CSAM) Investigation**\nImport image with PhotoDNA and Project VIC hash sets enabled, run Picture Analyzer module, hash all image files against known-bad databases, tag and categorize matches by severity, generate law enforcement report with chain of custody documentation.\n\n**Scenario 4: Intellectual Property Dispute**\nImport multiple employee disk images as separate data sources in one case, perform keyword searches for proprietary terms and project names, compare file hashes between sources, build timeline showing file access and transfer patterns, export evidence for legal review.\n\n## Output Format\n\n```\nAutopsy Case Analysis Summary:\n  Case:           CASE-2024-001-Workstation\n  Image:          evidence.dd (500GB NTFS)\n  Partitions:     2 (System Reserved + Primary)\n  Total Files:    245,832\n  Deleted Files:  12,456 (recoverable: 8,234)\n\n  Ingest Results:\n    Hash Matches (Known Bad):  3 files\n    Extension Mismatches:      17 files\n    Keyword Hits:              234 across 45 files\n    Encrypted Files:           5 containers detected\n    EXIF Data Extracted:       1,245 images with metadata\n\n  Tagged Evidence:\n    Critical:     12 items\n    Supporting:   34 items\n    Review:       67 items\n\n  Timeline Events:  1,234,567 entries (filtered to incident window: 892)\n  Report:          \u002Fcases\u002Fcase-2024-001\u002Freports\u002Fautopsy_report.html\n```\n",{"name":5,"tags":45,"author":46,"domain":29,"license":15,"version":47,"nist_csf":48,"subdomain":52,"description":7,"mitre_attack":53},[33,35,36,37,38,39],"mahipal","1.0",[49,50,51],"RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[54,55,56,57],"T1005","T1074.001","T1070.004","T1083","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-disk-image-with-autopsy",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-disk-image-with-autopsy",{"tool":74,"command":75},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-disk-image-with-autopsy",{"tool":77,"command":78},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-disk-image-with-autopsy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-disk-image-with-autopsy\u002FSKILL.md",true,[82,88,93,97],{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"agents\u002Fopenai.yaml","REFERENCE","参考文档",43,"https:\u002F\u002Fgithub.com\u002FHasarAli\u002Fdotfiles\u002Fblob\u002Fmain\u002Fdot-agents\u002Fskills\u002Fshow-me\u002Fagents\u002Fopenai.yaml",{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-disk-image-with-autopsy\u002FLICENSE",{"path":94,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md",2908,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-disk-image-with-autopsy\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",7729,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-disk-image-with-autopsy\u002Fscripts\u002Fagent.py",[104,130,154,182,207,234],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":111,"publishedAt":40},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[110],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,114,115,116,29,117,118,119,120,30,121,122,123,124,125,126,127,128,129],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":40},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[136],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[138,126,139,140,116,141,29,119,142,143,144,145,146,147,148,149,150,151,152,153],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":40},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[160,163],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[148,165,166,167,168,29,169,170,142,171,172,173,174,175,176,177,178,179,180,181],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":40},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,29,193,194,195,196,197,198,199,200,201,202,52,203,145,204,205,206],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":40},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,29,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":40},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[240],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[116,242,29,243,32,244,245,246,247,248,249,177,250,178,251,252,253,254,255,256],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]