disk-forensics

Name: disk-forensics
Author: briiirussell

320stars36forks

How to install disk-forensics?

briiirussell/cybersecurity-skills/disk-forensics

$npx -y skills add briiirussell/cybersecurity-skills --skill disk-forensics

Installs into the current project.

Summary

Analyze disk images, file systems, and memory captures for digital evidence recovery in forensic investigations and CTF challenges. Use when the user mentions 'disk forensics,' 'forensic analysis,' 'disk image,' 'file carving,' 'deleted files,' 'evidence recovery,' 'timeline anal

Files · 1

View on GitHub

SKILL.md

1	# Disk Forensics — Digital Evidence Analysis
2
3	Analyze disk images and file systems to recover evidence, reconstruct timelines, and identify artifacts.
4
5	Cross-references: `incident-triage` for the upstream containment phase that captures the image this skill analyzes — that skill makes the bit-for-bit copy; this skill analyzes it. `breach-patterns` for translating the forensic findings into preemptive controls so the same root cause doesn't recur.
6
7	## Authorization Check
8
9	Before analyzing any image, confirm:
10	1. Lawful basis — the user has authorization for this analysis (internal investigation with documented scope, court-ordered work, signed IR engagement, your own system, CTF / lab environment)
11	2. Chain of custody is preserved — the image and its hashes were captured in a way that survives evidentiary scrutiny, OR the scope is explicitly non-evidentiary (CTF, internal triage where chain-of-custody is not the goal)
12	3. Privacy scope — the analysis stays within what was authorized; personal data outside the scope is not pulled, analyzed, or reported
13
14	If lawful basis is unclear, ask before proceeding. Never analyze an image you cannot confirm the user is authorized to possess.
15
16	## Evidence Handling Principles
17
18	- Always work on copies, never originals
19	- Verify image integrity with hash comparison before analysis
20	- Mount everything read-only
21	- Document every command and finding
22	- Preserve timestamps — never modify source evidence
23
24	## Methodology
25
26	### Step 1: Image Identification and Integrity
27
28	Identify the image format and verify integrity:
29
30	```bash
31	file <image> # Identify format (E01, dd/raw, VMDK, VHD)
32	sha256sum <image> # Compare to provided hash
33	```
34
35	For E01 images, use `ewfinfo` to extract metadata.
36
37	### Step 2: Partition Layout
38
39	Examine the partition structure:
40
41	```bash
42	fdisk -l <image> # Partition table
43	mmls <image> # Sleuth Kit partition layout
44	```
45
46	Calculate mount offsets: `sector_start × sector_size`
47
48	### Step 3: Mount and Explore
49
50	Mount read-only and survey the file system:
51
52	```bash
53	mount -o ro,loop,offset=<bytes> <image> /mnt/evidence
54	ls -laR /mnt/evidence
55	```
56
57	For encrypted volumes, identify the encryption type and request the key/passphrase.
58
59	### Step 4: File System Analysis (Sleuth Kit)
60
61	```bash
62	fsstat -o <offset> <image> # File system details
63	fls -r -o <offset> <image> # Full file listing (deleted files marked with *)
64	icat -o <offset> <image> <inode> # Extract specific file by inode
65	```
66
67	### Step 5: Artifact Recovery
68
69	Deleted files: Use `fls` to find (marked with `*`), `icat` to extract by inode.
70
71	File carving: Run `foremost` or `scalpel` on unallocated space to recover files by header signatures.
72
73	Hidden data:
74	- NTFS alternate data streams
75	- HFS+ resource forks
76	- Check image files for steganography: `exiftool`, `binwalk`, `steghide`
77
78	System artifacts:
79	- Browser history: `~/.mozilla`, `~/Library/Safari`, `AppData\Local\Google`
80	- System logs: `/var/log/*`, Windows Event Logs
81	- Registry hives (Windows): SAM, SYSTEM, SOFTWARE, NTUSER.DAT
82	- Recently accessed files, USB device history, prefetch files
83
84	### Step 6: Metadata and Timestamps
85
86	```bash
87	exiftool <file> # EXIF, XMP, IPTC metadata
88	stat <file> # MAC times (Modified, Accessed, Changed)
89	```
90
91	For NTFS: examine `$MFT` timestamps and `$UsnJrnl` for change journal entries.
92
93	Use `mactime` (Sleuth Kit) to generate a unified timeline from body files.
94
95	### Step 7: Keyword Search
96
97	```bash
98	strings <image> \| grep -i <keyword> # Raw string search across image
99	```
100
101	Use `bulk_extractor` for automated extraction of emails, URLs, credit card numbers, and other structured data.
102
103	### Step 8: Timeline Construction
104
105	Collect all timestamps into a unified timeline. Cross-reference file events with log entries. Flag anomalies:
106	- Timestamps before the OS install date
107	- Future-dated files
108	- Gaps in otherwise continuous log sequences
109	- Timestamps inconsistent with timezone settings
110
111	## Output Format
112
113	```markdown
114	# Forensic Analysis Report
115	## Case: [identifier]
116	## Image: [filename] — SHA256: [hash]
117	## Date of Analysis: [date]
118
119	### Image Integrity
120	- Hash verified: [yes/no]
121	- Algorithm: [SHA256]
122
123	### Partition Layout
124	\| # \| Type \| Start \| Size \| File System \|
125	\|---\|------\|-------\|------\|-------------\|
126
127	### Key Findings
128	#### Finding 1: [Title]
129	- Evidence: [file path or artifact]
130	- **Co

People who liked this also viewed

6 picks

Type

disk-forensics

320stars36forks

View on GitHub

How to install disk-forensics?

briiirussell/cybersecurity-skills/disk-forensics

$npx -y skills add briiirussell/cybersecurity-skills --skill disk-forensics

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Disk Forensics — Digital Evidence Analysis
2
3	Analyze disk images and file systems to recover evidence, reconstruct timelines, and identify artifacts.
4
5	Cross-references: `incident-triage` for the upstream containment phase that captures the image this skill analyzes — that skill makes the bit-for-bit copy; this skill analyzes it. `breach-patterns` for translating the forensic findings into preemptive controls so the same root cause doesn't recur.
6
7	## Authorization Check
8
9	Before analyzing any image, confirm:
10	1. Lawful basis — the user has authorization for this analysis (internal investigation with documented scope, court-ordered work, signed IR engagement, your own system, CTF / lab environment)
11	2. Chain of custody is preserved — the image and its hashes were captured in a way that survives evidentiary scrutiny, OR the scope is explicitly non-evidentiary (CTF, internal triage where chain-of-custody is not the goal)
12	3. Privacy scope — the analysis stays within what was authorized; personal data outside the scope is not pulled, analyzed, or reported
13
14	If lawful basis is unclear, ask before proceeding. Never analyze an image you cannot confirm the user is authorized to possess.
15
16	## Evidence Handling Principles
17
18	- Always work on copies, never originals
19	- Verify image integrity with hash comparison before analysis
20	- Mount everything read-only
21	- Document every command and finding
22	- Preserve timestamps — never modify source evidence
23
24	## Methodology
25
26	### Step 1: Image Identification and Integrity
27
28	Identify the image format and verify integrity:
29
30	```bash
31	file <image> # Identify format (E01, dd/raw, VMDK, VHD)
32	sha256sum <image> # Compare to provided hash
33	```
34
35	For E01 images, use `ewfinfo` to extract metadata.
36
37	### Step 2: Partition Layout
38
39	Examine the partition structure:
40
41	```bash
42	fdisk -l <image> # Partition table
43	mmls <image> # Sleuth Kit partition layout
44	```
45
46	Calculate mount offsets: `sector_start × sector_size`
47
48	### Step 3: Mount and Explore
49
50	Mount read-only and survey the file system:
51
52	```bash
53	mount -o ro,loop,offset=<bytes> <image> /mnt/evidence
54	ls -laR /mnt/evidence
55	```
56
57	For encrypted volumes, identify the encryption type and request the key/passphrase.
58
59	### Step 4: File System Analysis (Sleuth Kit)
60
61	```bash
62	fsstat -o <offset> <image> # File system details
63	fls -r -o <offset> <image> # Full file listing (deleted files marked with *)
64	icat -o <offset> <image> <inode> # Extract specific file by inode
65	```
66
67	### Step 5: Artifact Recovery
68
69	Deleted files: Use `fls` to find (marked with `*`), `icat` to extract by inode.
70
71	File carving: Run `foremost` or `scalpel` on unallocated space to recover files by header signatures.
72
73	Hidden data:
74	- NTFS alternate data streams
75	- HFS+ resource forks
76	- Check image files for steganography: `exiftool`, `binwalk`, `steghide`
77
78	System artifacts:
79	- Browser history: `~/.mozilla`, `~/Library/Safari`, `AppData\Local\Google`
80	- System logs: `/var/log/*`, Windows Event Logs
81	- Registry hives (Windows): SAM, SYSTEM, SOFTWARE, NTUSER.DAT
82	- Recently accessed files, USB device history, prefetch files
83
84	### Step 6: Metadata and Timestamps
85
86	```bash
87	exiftool <file> # EXIF, XMP, IPTC metadata
88	stat <file> # MAC times (Modified, Accessed, Changed)
89	```
90
91	For NTFS: examine `$MFT` timestamps and `$UsnJrnl` for change journal entries.
92
93	Use `mactime` (Sleuth Kit) to generate a unified timeline from body files.
94
95	### Step 7: Keyword Search
96
97	```bash
98	strings <image> \| grep -i <keyword> # Raw string search across image
99	```
100
101	Use `bulk_extractor` for automated extraction of emails, URLs, credit card numbers, and other structured data.
102
103	### Step 8: Timeline Construction
104
105	Collect all timestamps into a unified timeline. Cross-reference file events with log entries. Flag anomalies:
106	- Timestamps before the OS install date
107	- Future-dated files
108	- Gaps in otherwise continuous log sequences
109	- Timestamps inconsistent with timezone settings
110
111	## Output Format
112
113	```markdown
114	# Forensic Analysis Report
115	## Case: [identifier]
116	## Image: [filename] — SHA256: [hash]
117	## Date of Analysis: [date]
118
119	### Image Integrity
120	- Hash verified: [yes/no]
121	- Algorithm: [SHA256]
122
123	### Partition Layout
124	\| # \| Type \| Start \| Size \| File System \|
125	\|---\|------\|-------\|------\|-------------\|
126
127	### Key Findings
128	#### Finding 1: [Title]
129	- Evidence: [file path or artifact]
130	- **Co

People who liked this also viewed

6 picks

Type