How do I install the Router Reverse Skill Router Digital Forensics skill?

Run npx skillmds@latest add netvar1337/router-reverse-skill-router-digital-forensics in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Router Reverse Skill Router Digital Forensics safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Router Reverse Skill Router Digital Forensics?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Router Reverse Skill Router Digital Forensics free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Router Reverse Skill Router Digital Forensics?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Router Reverse Skill Router Digital Forensics by netvar1337

Name: Router Reverse Skill Router Digital Forensics
Author: netvar1337

File contents

Digital Forensics & IR Artifacts

ACTION REQUIRED (execute immediately after reading)

NOW: read ../field-journal/precedent-pentest.md or the organization's IR authorization statement
NOW: confirm this is forensics/traceback, not offensive scanning
NOW: set up a case; read-only copies of evidence first (write-protect original media)
NEXT: tool-index; Volatility etc. are often manual
ACT: preservation hashes → timeline → key artifacts

Applicable Scenarios

Memory dump analysis (Volatility 2/3)
Disk / E01 / dropped-file timelines
PCAP traceback and protocol recovery (can combine with protocol-reverse/)
Host artifacts: Prefetch, Shimcache, Event Log, browser history
IR IOC extraction (combined with malware-analysis/ / threat-hunting/)

Workflow

1. Preservation

□ Compute SHA256; record timezone and acquisition commands
□ Work on copies; originals read-only
□ Note chain of custody into the timeline

2. Memory

vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline

3. Host Artifacts

□ Event logs: Security / PowerShell / Sysmon
□ Persistence: Run keys, services, scheduled tasks, WMI
□ Execution traces: Amcache, Prefetch, BAM

4. Network

□ tshark session and DNS statistics
□ Export suspicious streams → protocol-reverse or malware C2 analysis

Toolchain

Tool	Purpose
Volatility 3	Memory
Timeline Explorer / Plaso	Super timelines
tshark	PCAP
Eric Zimmerman toolset	Windows artifacts
Autopsy / FTK Imager	Disks

References

references/forensics-triage.md
../malware-analysis/ ../threat-hunting/ ../protocol-reverse/

Routing Context

Upstream: MASTER R25
Downstream: deep digging into malicious samples → malware-analysis; rules → threat-hunting

Task Completion Self-Check

Preservation hashes and copy policy in place?
Timeline independently reviewable?
IOCs sanitized and classified?
Checklist?

---name: router-reverse-skill-router-digital-forensicsdescription: Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.---# Digital Forensics & IR Artifacts## ACTION REQUIRED (execute immediately after reading)1. `NOW`: read `../field-journal/precedent-pentest.md` or the organization's IR authorization statement2. `NOW`: confirm this is **forensics/traceback**, not offensive scanning3. `NOW`: set up a case; read-only copies of evidence first (write-protect original media)4. `NEXT`: tool-index; Volatility etc. are often manual5. `ACT`: preservation hashes → timeline → key artifacts## Applicable Scenarios- Memory dump analysis (Volatility 2/3)- Disk / E01 / dropped-file timelines- PCAP traceback and protocol recovery (can combine with `protocol-reverse/`)- Host artifacts: Prefetch, Shimcache, Event Log, browser history- IR IOC extraction (combined with `malware-analysis/` / `threat-hunting/`)## Workflow### 1. Preservation```text□ Compute SHA256; record timezone and acquisition commands□ Work on copies; originals read-only□ Note chain of custody into the timeline```### 2. Memory```bashvol -f mem.dmp windows.infovol -f mem.dmp windows.pslistvol -f mem.dmp windows.netscanvol -f mem.dmp windows.cmdline```### 3. Host Artifacts```text□ Event logs: Security / PowerShell / Sysmon□ Persistence: Run keys, services, scheduled tasks, WMI□ Execution traces: Amcache, Prefetch, BAM```### 4. Network```text□ tshark session and DNS statistics□ Export suspicious streams → protocol-reverse or malware C2 analysis```## Toolchain| Tool | Purpose ||------|------|| Volatility 3 | Memory || Timeline Explorer / Plaso | Super timelines || tshark | PCAP || Eric Zimmerman toolset | Windows artifacts || Autopsy / FTK Imager | Disks |## References- `references/forensics-triage.md`- `../malware-analysis/` `../threat-hunting/` `../protocol-reverse/`## Routing Context**Upstream**: MASTER R25 **Downstream**: deep digging into malicious samples → malware-analysis; rules → threat-hunting## Task Completion Self-Check- [ ] Preservation hashes and copy policy in place?- [ ] Timeline independently reviewable?- [ ] IOCs sanitized and classified?- [ ] Checklist?

Frequently asked questions

Router Reverse Skill Router Digital Forensics