# Dfir Toolkit

> Use this skill when the user wants to cli tools for forensic investigation of windows artifacts.

- Skill: `javimosch/dfir-toolkit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add javimosch/dfir-toolkit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/javimosch/dfir-toolkit/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: javimosch (https://skillmd.com/u/javimosch)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/javimosch/dfir-toolkit

---


# Dfir-toolkit Plugin

CLI tools for forensic investigation of Windows artifacts.

## Commands

### Operations
- `dfir-toolkit artifact analyze` — analyze artifact via dfir-toolkit
- `dfir-toolkit artifact extract` — extract artifact via dfir-toolkit
- `dfir-toolkit registry parse` — parse registry via dfir-toolkit
- `dfir-toolkit event-log parse` — parse event-log via dfir-toolkit
- `dfir-toolkit timeline generate` — generate timeline via dfir-toolkit
- `dfir-toolkit report generate` — generate report via dfir-toolkit
- `dfir-toolkit config show` — show config via dfir-toolkit

## Usage Examples
- "dfir-toolkit --help"
- "dfir-toolkit <args>"

## Installation

```bash
cargo install dfir-toolkit
```

## Examples

```bash
dfir-toolkit --version
dfir-toolkit --help
```

## Key Features
- forensics\n- windows\n- security