How do I install the Digital Forensics skill?

Run npx skillmds@latest add stanfish06/digital-forensics in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Digital Forensics safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Digital Forensics?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Digital Forensics free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Digital Forensics?

stanfish06 (@stanfish06) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Digital Forensics by stanfish06 — Agent Skill

Name: Digital Forensics
Rating: 4.5 (4 reviews)
Author: stanfish06

File contents

Digital Forensics & IR Artifacts

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 ../reverse-skill-router/field-journal/precedent-pentest.md 或组织 IR 授权说明
NOW: 确认是取证/溯源而非进攻性扫描
NOW: 建立 case；证据只读副本优先（原始介质写保护）
NEXT: tool-index；Volatility 等常手动
ACT: 保全哈希 → 时间线 → 关键伪影

适用场景

内存转储分析（Volatility 2/3）
磁盘/ E01 / 落地文件时间线
PCAP 溯源与协议还原（可联合 protocol-reverse/）
主机伪影：Prefetch、Shimcache、Event Log、浏览器历史
应急响应 IOC 提炼（联合 malware-analysis/ / threat-hunting/）

工作流

1. 保全

□ 计算 SHA256；记录时区与采集命令
□ 工作在副本上；原始只读
□ chain of custody 备注写入 timeline

2. 内存

vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline

3. 主机伪影

□ 事件日志：Security / PowerShell / Sysmon
□ 持久化：Run 键、服务、计划任务、WMI
□ 执行痕迹：Amcache、Prefetch、BAM

4. 网络

□ tshark 统计会话与 DNS
□ 导出可疑流 → protocol-reverse 或 malware C2 分析

工具链

工具	用途
Volatility 3	内存
Timeline Explorer / Plaso	超级时间线
tshark	PCAP
Eric Zimmerman 工具集	Windows 伪影
Autopsy / FTK Imager	磁盘

参考

references/forensics-triage.md
../malware-analysis/ ../threat-hunting/ ../protocol-reverse/

路由上下文

上游: MASTER R25
下游: 恶意样本深挖 → malware-analysis；规则 → threat-hunting

任务完成自检

是否保全哈希与副本策略？
时间线是否可复核？
IOC 是否脱敏分级？
Checklist？

---name: digital-forensicsdescription: Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.---# Digital Forensics & IR Artifacts## ACTION REQUIRED（读完后立刻执行）1. `NOW`: 读取 `../reverse-skill-router/field-journal/precedent-pentest.md` 或组织 IR 授权说明2. `NOW`: 确认是**取证/溯源**而非进攻性扫描3. `NOW`: 建立 case；证据只读副本优先（原始介质写保护）4. `NEXT`: tool-index；Volatility 等常手动5. `ACT`: 保全哈希 → 时间线 → 关键伪影## 适用场景- 内存转储分析（Volatility 2/3）- 磁盘/ E01 / 落地文件时间线- PCAP 溯源与协议还原（可联合 `protocol-reverse/`）- 主机伪影：Prefetch、Shimcache、Event Log、浏览器历史- 应急响应 IOC 提炼（联合 `malware-analysis/` / `threat-hunting/`）## 工作流### 1. 保全```text□ 计算 SHA256；记录时区与采集命令□ 工作在副本上；原始只读□ chain of custody 备注写入 timeline```### 2. 内存```bashvol -f mem.dmp windows.infovol -f mem.dmp windows.pslistvol -f mem.dmp windows.netscanvol -f mem.dmp windows.cmdline```### 3. 主机伪影```text□ 事件日志：Security / PowerShell / Sysmon□ 持久化：Run 键、服务、计划任务、WMI□ 执行痕迹：Amcache、Prefetch、BAM```### 4. 网络```text□ tshark 统计会话与 DNS□ 导出可疑流 → protocol-reverse 或 malware C2 分析```## 工具链| 工具 | 用途 ||------|------|| Volatility 3 | 内存 || Timeline Explorer / Plaso | 超级时间线 || tshark | PCAP || Eric Zimmerman 工具集 | Windows 伪影 || Autopsy / FTK Imager | 磁盘 |## 参考- `references/forensics-triage.md`- `../malware-analysis/` `../threat-hunting/` `../protocol-reverse/`## 路由上下文**上游**: MASTER R25 **下游**: 恶意样本深挖 → malware-analysis；规则 → threat-hunting## 任务完成自检- [ ] 是否保全哈希与副本策略？- [ ] 时间线是否可复核？- [ ] IOC 是否脱敏分级？- [ ] Checklist？

Frequently asked questions

Digital Forensics