digital-forensics
starsforks
How to install digital-forensics?
zhaoxuya520/reverse-skill/digital-forensics
$npx -y skills add zhaoxuya520/reverse-skill --skill digital-forensicsUse for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
SKILL.md
| 1 | # Digital Forensics & IR Artifacts |
| 2 | |
| 3 | ## ACTION REQUIRED（读完后立刻执行） |
| 4 | |
| 5 | 1. `NOW`: 读取 `../field-journal/precedent-pentest.md` 或组织 IR 授权说明 |
| 6 | 2. `NOW`: 确认是**取证/溯源**而非进攻性扫描 |
| 7 | 3. `NOW`: 建立 case；证据只读副本优先（原始介质写保护） |
| 8 | 4. `NEXT`: tool-index；Volatility 等常手动 |
| 9 | 5. `ACT`: 保全哈希 → 时间线 → 关键伪影 |
| 10 | |
| 11 | ## 适用场景 |
| 12 | |
| 13 | - 内存转储分析（Volatility 2/3） |
| 14 | - 磁盘/ E01 / 落地文件时间线 |
| 15 | - PCAP 溯源与协议还原（可联合 `protocol-reverse/`） |
| 16 | - 主机伪影：Prefetch、Shimcache、Event Log、浏览器历史 |
| 17 | - 应急响应 IOC 提炼（联合 `malware-analysis/` / `threat-hunting/`） |
| 18 | |
| 19 | ## 工作流 |
| 20 | |
| 21 | ### 1. 保全 |
| 22 | |
| 23 | ```text |
| 24 | □ 计算 SHA256；记录时区与采集命令 |
| 25 | □ 工作在副本上；原始只读 |
| 26 | □ chain of custody 备注写入 timeline |
| 27 | ``` |
| 28 | |
| 29 | ### 2. 内存 |
| 30 | |
| 31 | ```bash |
| 32 | vol -f mem.dmp windows.info |
| 33 | vol -f mem.dmp windows.pslist |
| 34 | vol -f mem.dmp windows.netscan |
| 35 | vol -f mem.dmp windows.cmdline |
| 36 | ``` |
| 37 | |
| 38 | ### 3. 主机伪影 |
| 39 | |
| 40 | ```text |
| 41 | □ 事件日志：Security / PowerShell / Sysmon |
| 42 | □ 持久化：Run 键、服务、计划任务、WMI |
| 43 | □ 执行痕迹：Amcache、Prefetch、BAM |
| 44 | ``` |
| 45 | |
| 46 | ### 4. 网络 |
| 47 | |
| 48 | ```text |
| 49 | □ tshark 统计会话与 DNS |
| 50 | □ 导出可疑流 → protocol-reverse 或 malware C2 分析 |
| 51 | ``` |
| 52 | |
| 53 | ## 工具链 |
| 54 | |
| 55 | | 工具 | 用途 | |
| 56 | |------|------| |
| 57 | | Volatility 3 | 内存 | |
| 58 | | Timeline Explorer / Plaso | 超级时间线 | |
| 59 | | tshark | PCAP | |
| 60 | | Eric Zimmerman 工具集 | Windows 伪影 | |
| 61 | | Autopsy / FTK Imager | 磁盘 | |
| 62 | |
| 63 | ## 参考 |
| 64 | |
| 65 | - `references/forensics-triage.md` |
| 66 | - `../malware-analysis/` `../threat-hunting/` `../protocol-reverse/` |
| 67 | |
| 68 | ## 路由上下文 |
| 69 | |
| 70 | **上游**: MASTER R25 |
| 71 | **下游**: 恶意样本深挖 → malware-analysis；规则 → threat-hunting |
| 72 | |
| 73 | ## 任务完成自检 |
| 74 | |
| 75 | - [ ] 是否保全哈希与副本策略？ |
| 76 | - [ ] 时间线是否可复核？ |
| 77 | - [ ] IOC 是否脱敏分级？ |
| 78 | - [ ] Checklist？ |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
