[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADSNRG3XDHFQHKWZ48CB8R":3,"skill-same:01M6ADSNRG3XDHFQHKWZ48CB8R":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6ADSNRG3XDHFQHKWZ48CB8R","analyzing-slack-space-and-file-system-artifacts",null,"Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-slack-space-and-file-system-artifacts\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"slack","analyzing slack space and file system artifacts","analyzing","file","artifacts","metadata","change","forensics","mft","ntfs","usn-journal","cybersecurity","data","slack-space","alternate-data-streams","file-system-analysis","image","2026-11-10 10:12:30",false,"---\nname: analyzing-slack-space-and-file-system-artifacts\ndescription: Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- slack-space\n- ntfs\n- mft\n- usn-journal\n- alternate-data-streams\n- file-system-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1070.006\n- T1564.004\n- T1070.004\n- T1005\n- T1006\n---\n\n# Analyzing Slack Space and File System Artifacts\n\n## When to Use\n- When searching for hidden or residual data in file system slack space\n- For analyzing NTFS Master File Table (MFT) entries for deleted file metadata\n- When reconstructing file operations from the USN Change Journal\n- For detecting Alternate Data Streams (ADS) used to hide data or malware\n- During deep forensic analysis requiring examination beyond standard file recovery\n\n## Prerequisites\n- Forensic disk image with NTFS file system\n- The Sleuth Kit (TSK) tools: istat, icat, fls, blkls, blkstat\n- MFTECmd (Eric Zimmerman) for MFT parsing\n- MFTExplorer for interactive MFT analysis\n- Understanding of NTFS structures (MFT, $UsnJrnl, $LogFile, ADS)\n- Python with analyzeMFT or mft library for automated parsing\n\n## Workflow\n\n### Step 1: Identify and Extract NTFS File System Artifacts\n\n```bash\n# Determine partition layout\nmmls \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Extract key NTFS system files\n# $MFT - Master File Table\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 0 > \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FMFT\n\n# $UsnJrnl:$J - USN Change Journal\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 62-128 > \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FUsnJrnl_J\n\n# $LogFile - Transaction log\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 2 > \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FLogFile\n\n# Extract all slack space from the volume\nblkls -s -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd > \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw\n\n# Get file system information\nfsstat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | tee \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Ffs_info.txt\n```\n\n### Step 2: Analyze the Master File Table (MFT)\n\n```bash\n# Parse MFT with MFTECmd (Eric Zimmerman)\nMFTECmd.exe -f \"C:\\cases\\ntfs\\MFT\" --csv \"C:\\cases\\analysis\\\" --csvf mft_analysis.csv\n\n# Parse with analyzeMFT (Python)\npip install analyzeMFT\n\nanalyzeMFT.py -f \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FMFT \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmft_analysis.csv \\\n   -c\n\n# Custom MFT analysis with Python\npython3 \u003C\u003C 'PYEOF'\nfrom mft import PyMft\nimport csv\n\nmft = PyMft(open('\u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FMFT', 'rb').read())\n\ndeleted_files = []\nsuspicious_files = []\n\nfor entry in mft.entries():\n    if entry is None:\n        continue\n\n    filename = entry.get_filename()\n    if filename is None:\n        continue\n\n    is_deleted = not entry.is_active()\n    is_directory = entry.is_directory()\n    created = entry.get_created_timestamp()\n    modified = entry.get_modified_timestamp()\n    mft_modified = entry.get_mft_modified_timestamp()\n    size = entry.get_file_size()\n\n    # Flag deleted files for recovery\n    if is_deleted and not is_directory and size > 0:\n        deleted_files.append({\n            'filename': filename,\n            'size': size,\n            'created': str(created),\n            'modified': str(modified),\n            'entry_number': entry.entry_number\n        })\n\n    # Detect timestomping (MFT modified time != $SI modified time)\n    si_modified = entry.get_si_modified_timestamp()\n    fn_modified = entry.get_fn_modified_timestamp()\n    if si_modified and fn_modified:\n        if abs((si_modified - fn_modified).total_seconds()) > 86400:  # >1 day difference\n            suspicious_files.append({\n                'filename': filename,\n                'si_modified': str(si_modified),\n                'fn_modified': str(fn_modified),\n                'delta': str(si_modified - fn_modified)\n            })\n\nprint(f\"=== DELETED FILES (recoverable metadata) ===\")\nprint(f\"Total: {len(deleted_files)}\")\nfor f in deleted_files[:20]:\n    print(f\"  [{f['modified']}] {f['filename']} ({f['size']} bytes)\")\n\nprint(f\"\\n=== POTENTIAL TIMESTOMPING ===\")\nprint(f\"Total suspicious: {len(suspicious_files)}\")\nfor f in suspicious_files[:10]:\n    print(f\"  {f['filename']}: $SI={f['si_modified']}, $FN={f['fn_modified']} (delta: {f['delta']})\")\nPYEOF\n```\n\n### Step 3: Analyze Slack Space for Hidden Data\n\n```bash\n# Search slack space for strings\nstrings -a \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fslack_strings.txt\n\n# Search for specific patterns in slack space\ngrep -iab \"password\\|secret\\|confidential\\|credit.card\\|ssn\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fslack_keywords.txt\n\n# Analyze individual file slack\npython3 \u003C\u003C 'PYEOF'\nimport struct\n\n# File slack consists of:\n# 1. RAM slack: bytes between file end and next sector boundary (filled with RAM content or zeros)\n# 2. Drive slack: remaining sectors in the cluster after the last file sector\n\n# Analyze slack for specific MFT entries\n# Using Sleuth Kit to get file slack for a specific file\nimport subprocess\n\n# Get file details\nresult = subprocess.run(\n    ['istat', '-o', '2048', '\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd', '14523'],\n    capture_output=True, text=True\n)\nprint(result.stdout)\n\n# The output shows data runs - the last cluster may contain slack data\n# Calculate slack size: (allocated_size - file_size) bytes\nPYEOF\n\n# Search for file signatures in slack space (embedded files)\nforemost -t jpg,pdf,zip -i \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fslack_carved\u002F\n\n# Use bulk_extractor to find structured data in slack\nbulk_extractor -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbulk_extract\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw\n```\n\n### Step 4: Parse the USN Change Journal\n\n```bash\n# Parse USN Journal with MFTECmd\nMFTECmd.exe -f \"C:\\cases\\ntfs\\UsnJrnl_J\" --csv \"C:\\cases\\analysis\\\" --csvf usn_journal.csv\n\n# Python USN Journal parsing\npip install pyusn\n\npython3 \u003C\u003C 'PYEOF'\nimport struct\nimport csv\nfrom datetime import datetime, timedelta\n\ndef parse_usn_record(data, offset):\n    \"\"\"Parse a single USN_RECORD_V2.\"\"\"\n    if offset + 8 > len(data):\n        return None, offset\n\n    record_len = struct.unpack_from('\u003CI', data, offset)[0]\n    if record_len \u003C 56 or record_len > 65536 or offset + record_len > len(data):\n        return None, offset + 8\n\n    major_ver = struct.unpack_from('\u003CH', data, offset + 4)[0]\n    if major_ver != 2:\n        return None, offset + record_len\n\n    mft_ref = struct.unpack_from('\u003CQ', data, offset + 8)[0] & 0xFFFFFFFFFFFF\n    parent_ref = struct.unpack_from('\u003CQ', data, offset + 16)[0] & 0xFFFFFFFFFFFF\n    usn = struct.unpack_from('\u003CQ', data, offset + 24)[0]\n    timestamp = struct.unpack_from('\u003CQ', data, offset + 32)[0]\n    reason = struct.unpack_from('\u003CI', data, offset + 40)[0]\n    source_info = struct.unpack_from('\u003CI', data, offset + 44)[0]\n    security_id = struct.unpack_from('\u003CI', data, offset + 48)[0]\n    file_attrs = struct.unpack_from('\u003CI', data, offset + 52)[0]\n    filename_len = struct.unpack_from('\u003CH', data, offset + 56)[0]\n    filename_off = struct.unpack_from('\u003CH', data, offset + 58)[0]\n\n    name = data[offset + filename_off:offset + filename_off + filename_len].decode('utf-16-le', errors='ignore')\n\n    # Convert Windows FILETIME to datetime\n    ts = datetime(1601, 1, 1) + timedelta(microseconds=timestamp \u002F\u002F 10)\n\n    # Decode reason flags\n    reasons = []\n    reason_flags = {\n        0x01: 'DATA_OVERWRITE', 0x02: 'DATA_EXTEND', 0x04: 'DATA_TRUNCATION',\n        0x10: 'NAMED_DATA_OVERWRITE', 0x20: 'NAMED_DATA_EXTEND',\n        0x100: 'FILE_CREATE', 0x200: 'FILE_DELETE', 0x400: 'EA_CHANGE',\n        0x800: 'SECURITY_CHANGE', 0x1000: 'RENAME_OLD_NAME', 0x2000: 'RENAME_NEW_NAME',\n        0x4000: 'INDEXABLE_CHANGE', 0x8000: 'BASIC_INFO_CHANGE',\n        0x10000: 'HARD_LINK_CHANGE', 0x20000: 'COMPRESSION_CHANGE',\n        0x40000: 'ENCRYPTION_CHANGE', 0x80000: 'OBJECT_ID_CHANGE',\n        0x100000: 'REPARSE_POINT_CHANGE', 0x200000: 'STREAM_CHANGE',\n        0x80000000: 'CLOSE'\n    }\n    for flag, desc in reason_flags.items():\n        if reason & flag:\n            reasons.append(desc)\n\n    record = {\n        'timestamp': ts.strftime('%Y-%m-%d %H:%M:%S'),\n        'filename': name,\n        'mft_entry': mft_ref,\n        'parent_entry': parent_ref,\n        'reasons': '|'.join(reasons),\n        'usn': usn\n    }\n\n    return record, offset + record_len\n\n# Parse the journal\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FUsnJrnl_J', 'rb') as f:\n    data = f.read()\n\nrecords = []\noffset = 0\nwhile offset \u003C len(data) - 8:\n    record, offset = parse_usn_record(data, offset)\n    if record:\n        records.append(record)\n    else:\n        offset += 8  # Skip zeros\n\n# Filter for deletion events\ndeletions = [r for r in records if 'FILE_DELETE' in r['reasons']]\ncreations = [r for r in records if 'FILE_CREATE' in r['reasons']]\nrenames = [r for r in records if 'RENAME_NEW_NAME' in r['reasons']]\n\nprint(f\"Total USN records: {len(records)}\")\nprint(f\"File creations: {len(creations)}\")\nprint(f\"File deletions: {len(deletions)}\")\nprint(f\"File renames: {len(renames)}\")\n\nprint(\"\\n=== RECENT DELETIONS ===\")\nfor r in deletions[-20:]:\n    print(f\"  [{r['timestamp']}] DELETED: {r['filename']} (MFT#{r['mft_entry']})\")\n\n# Write full journal to CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusn_journal.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['timestamp', 'filename', 'mft_entry', 'parent_entry', 'reasons', 'usn'])\n    writer.writeheader()\n    writer.writerows(records)\nPYEOF\n```\n\n### Step 5: Detect and Analyze Alternate Data Streams\n\n```bash\n# List all Alternate Data Streams in the image\nfind \u002Fmnt\u002Fevidence -exec getfattr -d {} \\; 2>\u002Fdev\u002Fnull | grep -i \"ads\\|zone\\|stream\"\n\n# Using Sleuth Kit to find ADS\nfls -r -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | grep \":\" | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fads_list.txt\n\n# Extract specific ADS content\n# Format: icat image inode:ads_name\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 14523:hidden_stream \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fextracted_ads.bin\n\n# Check Zone.Identifier streams (download origin tracking)\nfls -r -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | grep \"Zone.Identifier\" | \\\n   while read line; do\n       inode=$(echo \"$line\" | awk '{print $2}' | tr -d ':')\n       echo \"=== $line ===\"\n       icat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \"${inode}:Zone.Identifier\" 2>\u002Fdev\u002Fnull\n       echo \"\"\n   done > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fzone_identifiers.txt\n\n# Zone.Identifier content reveals:\n# [ZoneTransfer]\n# ZoneId=3          (3 = Internet, indicating file was downloaded)\n# ReferrerUrl=https:\u002F\u002Fmalicious-site.com\u002Fpayload.exe\n# HostUrl=https:\u002F\u002Fcdn.malicious-site.com\u002Fpayload.exe\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| File slack | Unused space between file end and cluster boundary containing residual data |\n| RAM slack | Portion of slack from file end to sector boundary (historically filled with RAM) |\n| MFT ($MFT) | Master File Table - NTFS metadata database with entries for every file |\n| USN Journal ($UsnJrnl) | Change journal recording all file\u002Fdirectory modifications on NTFS |\n| Alternate Data Streams | NTFS feature allowing multiple data streams per file (hidden storage) |\n| $STANDARD_INFORMATION | MFT attribute with timestamps modifiable by user-mode applications |\n| $FILE_NAME | MFT attribute with timestamps only modifiable by the kernel |\n| Timestomping | Anti-forensic technique modifying file timestamps to avoid detection |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| MFTECmd | Eric Zimmerman MFT and USN Journal parser with CSV output |\n| MFTExplorer | Interactive GUI tool for MFT analysis |\n| analyzeMFT | Python MFT parser with CSV\u002FJSON output |\n| The Sleuth Kit | File system forensics toolkit (fls, icat, blkls, istat) |\n| bulk_extractor | Feature extraction from raw data including slack space |\n| NTFS Log Tracker | Tool for parsing $LogFile transaction records |\n| streams.exe | Sysinternals tool for listing NTFS Alternate Data Streams |\n| Plaso | Super-timeline tool parsing MFT and USN Journal |\n\n## Common Scenarios\n\n**Scenario 1: Anti-Forensics Detection via Timestomping**\nCompare $STANDARD_INFORMATION timestamps with $FILE_NAME timestamps in MFT entries, flag files where $SI timestamps predate $FN timestamps (impossible in normal operation), identify timestomped files as evidence of deliberate manipulation, correlate with other timeline evidence.\n\n**Scenario 2: Hidden Data in Alternate Data Streams**\nScan for ADS attached to files beyond the standard Zone.Identifier, extract ADS content for analysis, check for hidden executables or documents stored in ADS, correlate ADS creation with user activity timeline, document findings for evidence.\n\n**Scenario 3: Deleted File Reconstruction from MFT**\nParse MFT for inactive (deleted) entries, extract filenames, sizes, and timestamps of deleted files, recover file content using icat if data clusters are not overwritten, build list of deleted evidence files, correlate with USN Journal delete events.\n\n**Scenario 4: File Activity Reconstruction from USN Journal**\nParse the USN Change Journal for the investigation period, identify file creation, modification, rename, and deletion events, reconstruct the sequence of file operations, detect evidence of data staging (create, copy, compress, delete pattern), identify anti-forensic file wiping.\n\n## Output Format\n\n```\nFile System Artifact Analysis:\n  Volume: NTFS (Partition 2, 465 GB)\n  Cluster Size: 4096 bytes\n\n  MFT Analysis:\n    Total Entries: 456,789\n    Active Files: 234,567\n    Deleted Entries: 12,345 (8,901 with recoverable metadata)\n    Timestomped Files: 23 (SI\u002FFN mismatch detected)\n\n  USN Journal:\n    Records Parsed: 2,345,678\n    Date Range: 2024-01-01 to 2024-01-20\n    File Creations: 45,678\n    File Deletions: 23,456\n    File Renames: 12,345\n\n  Alternate Data Streams:\n    Total ADS Found: 1,234\n    Zone.Identifier: 890 (downloaded files)\n    Custom\u002FSuspicious ADS: 5 (hidden data detected)\n\n  Slack Space:\n    Total Slack: 12.3 GB\n    Keyword Hits: 45 (passwords, credit cards)\n    Carved Files: 23 from slack space\n\n  Suspicious Findings:\n    - 23 files with timestomped timestamps\n    - 5 files with hidden ADS containing data\n    - USN shows mass deletion on 2024-01-18 (anti-forensics)\n    - Slack space contains residual email fragments\n\n  Reports: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F\n```\n","# Analyzing Slack Space and File System Artifacts\n\n## When to Use\n- When searching for hidden or residual data in file system slack space\n- For analyzing NTFS Master File Table (MFT) entries for deleted file metadata\n- When reconstructing file operations from the USN Change Journal\n- For detecting Alternate Data Streams (ADS) used to hide data or malware\n- During deep forensic analysis requiring examination beyond standard file recovery\n\n## Prerequisites\n- Forensic disk image with NTFS file system\n- The Sleuth Kit (TSK) tools: istat, icat, fls, blkls, blkstat\n- MFTECmd (Eric Zimmerman) for MFT parsing\n- MFTExplorer for interactive MFT analysis\n- Understanding of NTFS structures (MFT, $UsnJrnl, $LogFile, ADS)\n- Python with analyzeMFT or mft library for automated parsing\n\n## Workflow\n\n### Step 1: Identify and Extract NTFS File System Artifacts\n\n```bash\n# Determine partition layout\nmmls \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Extract key NTFS system files\n# $MFT - Master File Table\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 0 > \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FMFT\n\n# $UsnJrnl:$J - USN Change Journal\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 62-128 > \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FUsnJrnl_J\n\n# $LogFile - Transaction log\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 2 > \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FLogFile\n\n# Extract all slack space from the volume\nblkls -s -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd > \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw\n\n# Get file system information\nfsstat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | tee \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Ffs_info.txt\n```\n\n### Step 2: Analyze the Master File Table (MFT)\n\n```bash\n# Parse MFT with MFTECmd (Eric Zimmerman)\nMFTECmd.exe -f \"C:\\cases\\ntfs\\MFT\" --csv \"C:\\cases\\analysis\\\" --csvf mft_analysis.csv\n\n# Parse with analyzeMFT (Python)\npip install analyzeMFT\n\nanalyzeMFT.py -f \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FMFT \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmft_analysis.csv \\\n   -c\n\n# Custom MFT analysis with Python\npython3 \u003C\u003C 'PYEOF'\nfrom mft import PyMft\nimport csv\n\nmft = PyMft(open('\u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FMFT', 'rb').read())\n\ndeleted_files = []\nsuspicious_files = []\n\nfor entry in mft.entries():\n    if entry is None:\n        continue\n\n    filename = entry.get_filename()\n    if filename is None:\n        continue\n\n    is_deleted = not entry.is_active()\n    is_directory = entry.is_directory()\n    created = entry.get_created_timestamp()\n    modified = entry.get_modified_timestamp()\n    mft_modified = entry.get_mft_modified_timestamp()\n    size = entry.get_file_size()\n\n    # Flag deleted files for recovery\n    if is_deleted and not is_directory and size > 0:\n        deleted_files.append({\n            'filename': filename,\n            'size': size,\n            'created': str(created),\n            'modified': str(modified),\n            'entry_number': entry.entry_number\n        })\n\n    # Detect timestomping (MFT modified time != $SI modified time)\n    si_modified = entry.get_si_modified_timestamp()\n    fn_modified = entry.get_fn_modified_timestamp()\n    if si_modified and fn_modified:\n        if abs((si_modified - fn_modified).total_seconds()) > 86400:  # >1 day difference\n            suspicious_files.append({\n                'filename': filename,\n                'si_modified': str(si_modified),\n                'fn_modified': str(fn_modified),\n                'delta': str(si_modified - fn_modified)\n            })\n\nprint(f\"=== DELETED FILES (recoverable metadata) ===\")\nprint(f\"Total: {len(deleted_files)}\")\nfor f in deleted_files[:20]:\n    print(f\"  [{f['modified']}] {f['filename']} ({f['size']} bytes)\")\n\nprint(f\"\\n=== POTENTIAL TIMESTOMPING ===\")\nprint(f\"Total suspicious: {len(suspicious_files)}\")\nfor f in suspicious_files[:10]:\n    print(f\"  {f['filename']}: $SI={f['si_modified']}, $FN={f['fn_modified']} (delta: {f['delta']})\")\nPYEOF\n```\n\n### Step 3: Analyze Slack Space for Hidden Data\n\n```bash\n# Search slack space for strings\nstrings -a \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fslack_strings.txt\n\n# Search for specific patterns in slack space\ngrep -iab \"password\\|secret\\|confidential\\|credit.card\\|ssn\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fslack_keywords.txt\n\n# Analyze individual file slack\npython3 \u003C\u003C 'PYEOF'\nimport struct\n\n# File slack consists of:\n# 1. RAM slack: bytes between file end and next sector boundary (filled with RAM content or zeros)\n# 2. Drive slack: remaining sectors in the cluster after the last file sector\n\n# Analyze slack for specific MFT entries\n# Using Sleuth Kit to get file slack for a specific file\nimport subprocess\n\n# Get file details\nresult = subprocess.run(\n    ['istat', '-o', '2048', '\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd', '14523'],\n    capture_output=True, text=True\n)\nprint(result.stdout)\n\n# The output shows data runs - the last cluster may contain slack data\n# Calculate slack size: (allocated_size - file_size) bytes\nPYEOF\n\n# Search for file signatures in slack space (embedded files)\nforemost -t jpg,pdf,zip -i \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fslack_carved\u002F\n\n# Use bulk_extractor to find structured data in slack\nbulk_extractor -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbulk_extract\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fntfs\u002Fslack_space.raw\n```\n\n### Step 4: Parse the USN Change Journal\n\n```bash\n# Parse USN Journal with MFTECmd\nMFTECmd.exe -f \"C:\\cases\\ntfs\\UsnJrnl_J\" --csv \"C:\\cases\\analysis\\\" --csvf usn_journal.csv\n\n# Python USN Journal parsing\npip install pyusn\n\npython3 \u003C\u003C 'PYEOF'\nimport struct\nimport csv\nfrom datetime import datetime, timedelta\n\ndef parse_usn_record(data, offset):\n    \"\"\"Parse a single USN_RECORD_V2.\"\"\"\n    if offset + 8 > len(data):\n        return None, offset\n\n    record_len = struct.unpack_from('\u003CI', data, offset)[0]\n    if record_len \u003C 56 or record_len > 65536 or offset + record_len > len(data):\n        return None, offset + 8\n\n    major_ver = struct.unpack_from('\u003CH', data, offset + 4)[0]\n    if major_ver != 2:\n        return None, offset + record_len\n\n    mft_ref = struct.unpack_from('\u003CQ', data, offset + 8)[0] & 0xFFFFFFFFFFFF\n    parent_ref = struct.unpack_from('\u003CQ', data, offset + 16)[0] & 0xFFFFFFFFFFFF\n    usn = struct.unpack_from('\u003CQ', data, offset + 24)[0]\n    timestamp = struct.unpack_from('\u003CQ', data, offset + 32)[0]\n    reason = struct.unpack_from('\u003CI', data, offset + 40)[0]\n    source_info = struct.unpack_from('\u003CI', data, offset + 44)[0]\n    security_id = struct.unpack_from('\u003CI', data, offset + 48)[0]\n    file_attrs = struct.unpack_from('\u003CI', data, offset + 52)[0]\n    filename_len = struct.unpack_from('\u003CH', data, offset + 56)[0]\n    filename_off = struct.unpack_from('\u003CH', data, offset + 58)[0]\n\n    name = data[offset + filename_off:offset + filename_off + filename_len].decode('utf-16-le', errors='ignore')\n\n    # Convert Windows FILETIME to datetime\n    ts = datetime(1601, 1, 1) + timedelta(microseconds=timestamp \u002F\u002F 10)\n\n    # Decode reason flags\n    reasons = []\n    reason_flags = {\n        0x01: 'DATA_OVERWRITE', 0x02: 'DATA_EXTEND', 0x04: 'DATA_TRUNCATION',\n        0x10: 'NAMED_DATA_OVERWRITE', 0x20: 'NAMED_DATA_EXTEND',\n        0x100: 'FILE_CREATE', 0x200: 'FILE_DELETE', 0x400: 'EA_CHANGE',\n        0x800: 'SECURITY_CHANGE', 0x1000: 'RENAME_OLD_NAME', 0x2000: 'RENAME_NEW_NAME',\n        0x4000: 'INDEXABLE_CHANGE', 0x8000: 'BASIC_INFO_CHANGE',\n        0x10000: 'HARD_LINK_CHANGE', 0x20000: 'COMPRESSION_CHANGE',\n        0x40000: 'ENCRYPTION_CHANGE', 0x80000: 'OBJECT_ID_CHANGE',\n        0x100000: 'REPARSE_POINT_CHANGE', 0x200000: 'STREAM_CHANGE',\n        0x80000000: 'CLOSE'\n    }\n    for flag, desc in reason_flags.items():\n        if reason & flag:\n            reasons.append(desc)\n\n    record = {\n        'timestamp': ts.strftime('%Y-%m-%d %H:%M:%S'),\n        'filename': name,\n        'mft_entry': mft_ref,\n        'parent_entry': parent_ref,\n        'reasons': '|'.join(reasons),\n        'usn': usn\n    }\n\n    return record, offset + record_len\n\n# Parse the journal\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fntfs\u002FUsnJrnl_J', 'rb') as f:\n    data = f.read()\n\nrecords = []\noffset = 0\nwhile offset \u003C len(data) - 8:\n    record, offset = parse_usn_record(data, offset)\n    if record:\n        records.append(record)\n    else:\n        offset += 8  # Skip zeros\n\n# Filter for deletion events\ndeletions = [r for r in records if 'FILE_DELETE' in r['reasons']]\ncreations = [r for r in records if 'FILE_CREATE' in r['reasons']]\nrenames = [r for r in records if 'RENAME_NEW_NAME' in r['reasons']]\n\nprint(f\"Total USN records: {len(records)}\")\nprint(f\"File creations: {len(creations)}\")\nprint(f\"File deletions: {len(deletions)}\")\nprint(f\"File renames: {len(renames)}\")\n\nprint(\"\\n=== RECENT DELETIONS ===\")\nfor r in deletions[-20:]:\n    print(f\"  [{r['timestamp']}] DELETED: {r['filename']} (MFT#{r['mft_entry']})\")\n\n# Write full journal to CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusn_journal.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['timestamp', 'filename', 'mft_entry', 'parent_entry', 'reasons', 'usn'])\n    writer.writeheader()\n    writer.writerows(records)\nPYEOF\n```\n\n### Step 5: Detect and Analyze Alternate Data Streams\n\n```bash\n# List all Alternate Data Streams in the image\nfind \u002Fmnt\u002Fevidence -exec getfattr -d {} \\; 2>\u002Fdev\u002Fnull | grep -i \"ads\\|zone\\|stream\"\n\n# Using Sleuth Kit to find ADS\nfls -r -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | grep \":\" | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fads_list.txt\n\n# Extract specific ADS content\n# Format: icat image inode:ads_name\nicat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd 14523:hidden_stream \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fextracted_ads.bin\n\n# Check Zone.Identifier streams (download origin tracking)\nfls -r -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | grep \"Zone.Identifier\" | \\\n   while read line; do\n       inode=$(echo \"$line\" | awk '{print $2}' | tr -d ':')\n       echo \"=== $line ===\"\n       icat -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \"${inode}:Zone.Identifier\" 2>\u002Fdev\u002Fnull\n       echo \"\"\n   done > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fzone_identifiers.txt\n\n# Zone.Identifier content reveals:\n# [ZoneTransfer]\n# ZoneId=3          (3 = Internet, indicating file was downloaded)\n# ReferrerUrl=https:\u002F\u002Fmalicious-site.com\u002Fpayload.exe\n# HostUrl=https:\u002F\u002Fcdn.malicious-site.com\u002Fpayload.exe\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| File slack | Unused space between file end and cluster boundary containing residual data |\n| RAM slack | Portion of slack from file end to sector boundary (historically filled with RAM) |\n| MFT ($MFT) | Master File Table - NTFS metadata database with entries for every file |\n| USN Journal ($UsnJrnl) | Change journal recording all file\u002Fdirectory modifications on NTFS |\n| Alternate Data Streams | NTFS feature allowing multiple data streams per file (hidden storage) |\n| $STANDARD_INFORMATION | MFT attribute with timestamps modifiable by user-mode applications |\n| $FILE_NAME | MFT attribute with timestamps only modifiable by the kernel |\n| Timestomping | Anti-forensic technique modifying file timestamps to avoid detection |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| MFTECmd | Eric Zimmerman MFT and USN Journal parser with CSV output |\n| MFTExplorer | Interactive GUI tool for MFT analysis |\n| analyzeMFT | Python MFT parser with CSV\u002FJSON output |\n| The Sleuth Kit | File system forensics toolkit (fls, icat, blkls, istat) |\n| bulk_extractor | Feature extraction from raw data including slack space |\n| NTFS Log Tracker | Tool for parsing $LogFile transaction records |\n| streams.exe | Sysinternals tool for listing NTFS Alternate Data Streams |\n| Plaso | Super-timeline tool parsing MFT and USN Journal |\n\n## Common Scenarios\n\n**Scenario 1: Anti-Forensics Detection via Timestomping**\nCompare $STANDARD_INFORMATION timestamps with $FILE_NAME timestamps in MFT entries, flag files where $SI timestamps predate $FN timestamps (impossible in normal operation), identify timestomped files as evidence of deliberate manipulation, correlate with other timeline evidence.\n\n**Scenario 2: Hidden Data in Alternate Data Streams**\nScan for ADS attached to files beyond the standard Zone.Identifier, extract ADS content for analysis, check for hidden executables or documents stored in ADS, correlate ADS creation with user activity timeline, document findings for evidence.\n\n**Scenario 3: Deleted File Reconstruction from MFT**\nParse MFT for inactive (deleted) entries, extract filenames, sizes, and timestamps of deleted files, recover file content using icat if data clusters are not overwritten, build list of deleted evidence files, correlate with USN Journal delete events.\n\n**Scenario 4: File Activity Reconstruction from USN Journal**\nParse the USN Change Journal for the investigation period, identify file creation, modification, rename, and deletion events, reconstruct the sequence of file operations, detect evidence of data staging (create, copy, compress, delete pattern), identify anti-forensic file wiping.\n\n## Output Format\n\n```\nFile System Artifact Analysis:\n  Volume: NTFS (Partition 2, 465 GB)\n  Cluster Size: 4096 bytes\n\n  MFT Analysis:\n    Total Entries: 456,789\n    Active Files: 234,567\n    Deleted Entries: 12,345 (8,901 with recoverable metadata)\n    Timestomped Files: 23 (SI\u002FFN mismatch detected)\n\n  USN Journal:\n    Records Parsed: 2,345,678\n    Date Range: 2024-01-01 to 2024-01-20\n    File Creations: 45,678\n    File Deletions: 23,456\n    File Renames: 12,345\n\n  Alternate Data Streams:\n    Total ADS Found: 1,234\n    Zone.Identifier: 890 (downloaded files)\n    Custom\u002FSuspicious ADS: 5 (hidden data detected)\n\n  Slack Space:\n    Total Slack: 12.3 GB\n    Keyword Hits: 45 (passwords, credit cards)\n    Carved Files: 23 from slack space\n\n  Suspicious Findings:\n    - 23 files with timestomped timestamps\n    - 5 files with hidden ADS containing data\n    - USN shows mass deletion on 2024-01-18 (anti-forensics)\n    - Slack space contains residual email fragments\n\n  Reports: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F\n```\n",{"name":5,"tags":54,"author":55,"domain":43,"license":15,"version":56,"nist_csf":57,"subdomain":61,"description":7,"mitre_attack":62},[39,45,41,40,42,46,47],"mahipal","1.0",[58,59,60],"RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[63,64,65,66,67],"T1070.006","T1564.004","T1070.004","T1005","T1006","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-slack-space-and-file-system-artifacts",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-slack-space-and-file-system-artifacts",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-slack-space-and-file-system-artifacts",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-slack-space-and-file-system-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-slack-space-and-file-system-artifacts\u002FSKILL.md",true,[92,97,103],{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-slack-space-and-file-system-artifacts\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",1933,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-slack-space-and-file-system-artifacts\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",6680,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-slack-space-and-file-system-artifacts\u002Fscripts\u002Fagent.py",[110,136,160,188,211,238],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[116],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[118,119,120,121,122,43,123,124,125,126,36,127,128,129,130,131,132,133,134,135],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[142],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[144,132,145,146,122,147,43,125,148,149,150,151,152,153,154,155,156,157,158,159],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":170,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[166,169],{"categoryNo":167,"categoryName":168,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[154,171,172,173,174,43,175,176,148,177,178,179,180,181,182,183,184,185,186,187],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":195,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[194],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[196,197,198,43,199,200,201,202,203,40,204,44,205,206,61,207,151,208,209,210],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mftecmd","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[217],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,43,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[244],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[122,246,43,247,35,248,249,250,251,252,253,183,254,184,255,256,257,258,259,260],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]