Digital Forensics & IR Triage
Guides an agent through authorized memory, disk, PCAP and host-artifact forensics with evidence preservation
- Repository
- zhaoxuya520/reverse-skill
- Stars
- 43,969
- Licence
- MIT
- Files
- 2 files
What it does
When installed, this skill gives the agent a structured forensics workflow for incident response: first hashing and preserving evidence on working copies, then analysing memory dumps with Volatility, building disk and event timelines, reviewing network captures with tshark, and extracting indicators of compromise. It also points to other related skills for deeper malware or protocol work. The instructions are written mostly in Chinese, with tool commands included.
Great for
- Incident responders who want a checklist-driven triage process
- Security analysts working on authorized investigations of memory dumps or PCAP files
- Students learning the order of forensic steps: preserve, analyse, timeline, IOCs
Skip it if
- Offensive scanning or attacking systems without written authorization, since the skill is meant only for authorized forensics and the agent must confirm this first
- Legal evidence handling where a qualified examiner's chain-of-custody procedures are required, because the skill is a guide and not a certified process
Try asking
- “Analyse this memory dump with Volatility and list suspicious processes and network connections”
- “Build a timeline from these Windows event logs and Prefetch files for our incident”
- “Summarise the main hosts and DNS queries in this PCAP and extract indicators of compromise”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
digital-forensics.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip digital-forensics.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip digital-forensics.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Give the agent written authorization or case scope in the request before starting, since the skill asks it to confirm this first
- Always work on copies of evidence and keep the SHA256 hashes the agent records
- Review the agent's commands before running them, because the tools it names are often run manually in practice
What's inside
- references/forensics-triage.md
- SKILL.md
Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.