Guide · Agent skill
How to use the Digital Forensics & IR Triage agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Digital Forensics & IR Triage skill (skill name digital-forensics) gives an AI agent a structured forensics workflow for authorized investigations. It is aimed at incident responders, security analysts and students who want a repeatable order of steps: preserve evidence, analyse memory, build timelines, review network captures and extract indicators of compromise. After this guide you will know what the skill does, how to install it, how to ask for it in plain language, and what to check before relying on its output.
Digital Forensics & IR Triagezhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it. Keep SKILL.md and the references folder together.
- 2Place the skill folder. Move it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install the tools. Install Volatility 3 for memory and tshark for PCAP. Add Plaso, Timeline Explorer, Eric Zimmerman tools, or Autopsy and FTK Imager only if your work needs them.
- 4State authorization and goal. Tell the agent the investigation is authorized and name the evidence type and the outcome you want.
- 5Let the agent preserve evidence. The agent hashes the evidence with SHA256 and works on copies with originals read-only.
- 6Review the findings. Check each finding's confidence level and evidence path, then verify IOCs before sharing them.
What does the skill make the agent do?
The skill sets a checklist-driven triage process for incident response. Its workflow starts with preservation: the agent calculates a SHA256 hash, records the time zone and collection commands, and works on copies while keeping originals read-only. Only after that does it move to analysis.
After preservation, the skill covers memory dumps with Volatility 3, host artifacts such as event logs, persistence locations, and execution traces, network captures with tshark, and extraction of indicators of compromise. It also points to related skills for deeper malware or protocol work.
- Preserve: SHA256 hashing, working copies, chain-of-custody notes in the timeline
- Memory: Volatility 3 process, network, and command-line views
- Host artifacts: Security, PowerShell and Sysmon logs; Run keys, services, scheduled tasks, WMI; Amcache, Prefetch, BAM
- Network: tshark session and DNS statistics, export of suspicious streams
- Output: a findings table with Time, Host, Artifact, Finding, Confidence and Evidence path fields
How do you install the digital-forensics skill?
Download the ZIP for this skill from this page and unzip it. For a personal setup, place the skill folder inside ~/.claude/skills/. For a single project, place it inside that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
The package contains SKILL.md and references/forensics-triage.md. Keep the references folder alongside SKILL.md so the agent can read the triage order and output template.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/
- Claude apps: Settings → Capabilities → Skills, then upload
What do you need installed before you start?
The skill itself only supplies instructions. The analysis is done by external tools, so install the ones matching your evidence. Volatility 3 is needed for memory analysis and tshark for PCAP analysis. The others are optional and depend on the work: Plaso and Timeline Explorer for timelines, Eric Zimmerman tools for Windows artifacts, and Autopsy or FTK Imager for disk work.
The skill is documented in mostly Chinese, with tool commands included. The commands below are the examples shown in the source.
- Required for memory: Volatility 3
- Required for PCAP: tshark
- Optional: Plaso and Timeline Explorer (timelines)
- Optional: Eric Zimmerman tools (Windows artifacts)
- Optional: Autopsy or FTK Imager (disk)
vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdlineHow do you trigger the skill with a natural request?
You do not need special syntax. Describe the task and the evidence you have, and state that the investigation is authorized. The skill tells the agent to confirm that the work is forensics or incident response rather than offensive scanning before it proceeds, so mention the authorization context up front.
Good requests name the evidence type (memory dump, disk image, PCAP) and the goal (triage, timeline, IOCs).
- "We have written authorization for this IR case. Triage the memory dump at mem.dmp using the digital-forensics skill."
- "Build a timeline from this disk image and preserve hashes first."
- "Review capture.pcap for suspicious DNS and sessions, then list IOC candidates."
What does a typical session look like?
The agent first asks for or confirms the authorization and sets up a case, preferring read-only working copies. It then works through the steps in order: hashing and preservation, memory triage, host artifacts, network review, and IOC extraction. Results are organised in the output template so each finding has a confidence level and an evidence path.
Expect the agent to use the tools you have installed. Where a tool is missing, you should install it first, as the source lists Volatility and tshark as the main dependencies.
- Confirms authorization and purpose
- Creates a case and preserves evidence on copies
- Runs memory, host, and network checks in order
- Records findings with Time, Host, Artifact, Finding, Confidence and Evidence path
What are the safety notes for scripts and network use?
The skill does not run scripts and does not use the network, according to its listing. It is a set of instructions that tells the agent which forensic tools to run. Those tools operate on evidence you provide locally.
Use it only for authorized forensics. The skill is not meant for offensive scanning or attacking systems without written authorization, and the agent must confirm this first. It is also a guide, not a certified process, so legal evidence handling that requires a qualified examiner's chain-of-custody procedures should follow that examiner's rules.
- Runs scripts: no
- Uses network: no
- Authorized use only; the agent must confirm before proceeding
- Not a substitute for a qualified examiner's chain-of-custody process
What tips help you get reliable results?
Always preserve before analysing. Hash the original, then work on a copy so the source stays unchanged. Keep your own notes on time zones and collection commands, since the skill asks for them to be recorded.
Treat the output as a structured starting point. Check each finding against its evidence path and confidence rating, and verify IOCs before sharing them. Where a case needs deeper malware or protocol work, ask the agent to use the related skills it references.
- Hash originals before any analysis
- Use read-only media or copies
- Record time zone and collection commands
- Verify each finding against its evidence path
- Ask for related skills when you need deeper malware or protocol analysis
What people use it for
- Triaging a memory dump for processes, network connections and command lines using Volatility 3
- Building a disk or event timeline with Plaso and Timeline Explorer for an incident review
- Reviewing a PCAP for sessions and DNS activity with tshark, then listing IOC candidates
- Checking Windows hosts for persistence and execution traces such as Run keys, services, Amcache and Prefetch
- Teaching students the order of forensic steps: preserve, analyse, timeline, IOCs
Frequently asked questions
How do I install the digital-forensics agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
What do I need to run the digital-forensics skill?
Volatility 3 is required for memory analysis and tshark for PCAP analysis. Plaso and Timeline Explorer, Eric Zimmerman tools, and Autopsy or FTK Imager are optional and depend on the type of work.
Is the digital-forensics skill free to use?
The source lists the skill under the MIT licence. The tools it relies on, such as Volatility 3 and tshark, are separate projects with their own licences, which you should check before use.
Does the skill run scripts or use the network?
According to its listing, the skill runs no scripts and uses no network. It gives the agent instructions and relies on the forensic tools you install locally.
Can I use this skill for offensive testing or scanning?
No. The skill is meant only for authorized forensics, and the agent must confirm that the work is investigation rather than offensive scanning before it proceeds.
Can this skill replace a certified forensic examiner?
No. It is a guide and not a certified process, so legal evidence handling that needs chain-of-custody procedures should be run by a qualified examiner.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits incident responders, analysts and students who want a checklist-driven forensic order for authorized memory, timeline, PCAP and IOC work. It is less suited to people who need a certified legal evidence process, or who cannot read the mostly Chinese instructions and need English-only guidance.
Download the skill