# Dfir Workflow

> Use for digital forensics / incident response workflows — memory, disk, timeline. Defensive investigation. Prefer Volatility3, Velociraptor, Plaso, Autopsy from catalog URLs.

- Skill: `tomjiu/dfir-workflow` (Agent Skill)
- Install (CLI): `npx skillmds@latest add tomjiu/dfir-workflow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomjiu/dfir-workflow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: tomjiu (https://skillmd.com/u/tomjiu)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/tomjiu/dfir-workflow

---


# DFIR Workflow

## Scope

Defensive investigation on systems/data you are authorized to examine.

## Canonical tools (catalog)

| Need | Tool | Catalog section |
|------|------|-----------------|
| Memory | Volatility3 | `dfir` |
| Endpoint | Velociraptor | `dfir` |
| Timeline | Plaso / Timesketch | `dfir` |
| Disk | Autopsy / Sleuth Kit | `dfir` |

Local URLs: `E:\Code\skills\catalog\sources.yaml`

## Flow

1. Preserve evidence (hash, read-only)
2. Triage: what, when, which hosts
3. Memory and/or disk analysis with official tools
4. Timeline + IOCs
5. Report: facts first, confidence levels

## Related

- `security-workflow`
- `systematic-debugging` for tooling failures
- `verification-before-completion` before closing incident