Plugins

1 plugin

The shared foundation of the Han suite: the specialist agent roster the other plugins dispatch, the project-discovery skill with its project-scanner agent, and the canonical evidence and YAGNI rule files. The documentation skills live in han-documentation, the pre-planning research skills in han-research, the planning skills in han-planning, and the coding skills in han-coding; each depends on han

2 skills · plugin

Results for “file-discovery”

13 skills

Performing Disk Forensics Investigation

Conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases.

24.6k · bundle

Analyzing Disk Image With Autopsy

Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.

24.6k · bundle

Analyzing Slack Space And File System Artifacts

Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.

24.6k · bundle

Recovering Deleted Files With Photorec

Recover deleted files from disk images and storage media using PhotoRec's file signature-based carving engine, regardless of file system damage.

24.6k · bundle

Performing Steganography Detection

Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.

24.6k · bundle

Analyzing Mft For Deleted File Recovery

Recover metadata and content of deleted files from NTFS volumes by analyzing the Master File Table, $LogFile, $UsnJrnl, and MFT slack space using forensic tools like MFTECmd and analyzeMFT.

24.6k · bundle

Hunting For Data Staging Before Exfiltration

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

24.6k · bundle

Deploying Decoy Files For Ransomware Detection

Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time using file integrity monitoring or OS-level watchdogs.

24.6k · bundle

Hunting For Defense Evasion Via Timestomping

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

24.6k · bundle

Acquiring Disk Image With Dd And Dcfldd

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.

24.6k · bundle

Extracting Memory Artifacts With Rekall

Analyze Windows memory dumps for signs of compromise using the Rekall memory forensics framework, including process injection, hidden processes, and rootkit detection.

24.6k · bundle

Performing File Carving With Foremost

Recover files from disk images and unallocated space using Foremost's header-footer signature carving to extract evidence regardless of file system state.

24.6k · bundle

Analyzing Windows Shellbag Artifacts

Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.

24.6k · bundle