From cybersecurity-skills
Guides disk forensics investigations using FTK Imager for imaging, Autopsy/Sleuth Kit for file recovery, artifact analysis, and timeline reconstruction in incident response cases.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsThis skill uses the workspace's default tool permissions.
- A security incident requires forensic analysis of a system's persistent storage
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
Do not use for volatile evidence (running processes, network connections); use memory forensics with Volatility instead.
Before touching any storage media, establish chain of custody:
Chain of Custody Record:
━━━━━━━━━━━━━━━━━━━━━━━
Case ID: INC-2025-1547
Evidence ID: EVD-001
Description: Samsung 870 EVO 500GB SSD
Serial Number: S5XXNJ0R912345
Source Host: WKSTN-042
Acquired By: [Analyst Name]
Date/Time: 2025-11-15T16:30:00Z
Write Blocker: Tableau T35u (S/N: T35U-12345)
Produce a bit-for-bit copy of the evidence drive:
Using FTK Imager (Windows):
Using dcfldd (Linux):
# Create raw image with hash verification
dcfldd if=/dev/sdb of=/evidence/WKSTN-042.dd \
hash=sha256 hashlog=/evidence/WKSTN-042.sha256 \
bs=4096 conv=noerror,sync
# Verify image integrity
sha256sum /evidence/WKSTN-042.dd
Imaging Summary:
Source Drive: /dev/sdb (Samsung 870 EVO 500GB)
Image File: WKSTN-042.E01
Image Format: E01 (Expert Witness)
Source Hash: SHA-256: a1b2c3d4e5f6...
Image Hash: SHA-256: a1b2c3d4e5f6... (MATCH)
Sectors Read: 976,773,168
Errors: 0
Duration: 47 minutes
Open the forensic image in Autopsy or FTK and examine the file system:
Key Windows Artifacts to Examine:
User Activity:
- NTUSER.DAT (registry hive per user)
- UsrClass.dat (shellbags, file access history)
- Recent files: %AppData%\Microsoft\Windows\Recent\
- Jump lists: %AppData%\Microsoft\Windows\Recent\AutomaticDestinations\
Program Execution:
- Prefetch: C:\Windows\Prefetch\*.pf
- Amcache: C:\Windows\appcompat\Programs\Amcache.hve
- SRUM: C:\Windows\System32\SRU\SRUDB.dat
- ShimCache: SYSTEM registry hive
Persistence:
- Scheduled Tasks: C:\Windows\System32\Tasks\
- Startup folders: %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\
- Services: SYSTEM registry hive
Network:
- WLAN profiles: C:\ProgramData\Microsoft\Wlansvc\Profiles\
- Browser history: Chrome, Firefox, Edge profile directories
Build a comprehensive timeline of file system activity:
Using Autopsy Timeline Module:
Using The Sleuth Kit (command line):
# Generate body file from NTFS image
fls -r -m / WKSTN-042.dd > bodyfile.txt
# Create timeline from body file
mactime -b bodyfile.txt -d > timeline.csv
# Filter timeline to investigation period
grep "2025-11-15" timeline.csv | sort > incident_timeline.csv
Extract and analyze specific forensic artifacts:
Compile a forensic analysis report suitable for legal proceedings:
| Term | Definition |
|---|---|
| Forensic Image | Bit-for-bit copy of storage media that preserves all data including deleted files and unallocated space |
| Write Blocker | Hardware or software device that prevents any modification to evidence media during acquisition |
| E01 Format | Expert Witness Format used by EnCase and FTK; supports compression, metadata, and built-in hash verification |
| File Carving | Recovery technique that searches unallocated disk space for file headers and footers to reconstruct deleted files |
| MFT (Master File Table) | NTFS metadata structure containing entries for every file and directory, including deleted entries |
| MAC Timestamps | Modified, Accessed, Created timestamps on files used for timeline reconstruction (NTFS also has Entry Modified) |
| Prefetch | Windows artifact recording program execution metadata; contains execution count, timestamps, and loaded DLLs |
| Unallocated Space | Disk sectors not assigned to any file; may contain remnants of deleted files recoverable through carving |
Context: An employee submitted a resignation and is suspected of copying proprietary files to a USB drive before departing. HR requests a forensic investigation of the employee's workstation.
Approach:
Pitfalls:
DISK FORENSICS INVESTIGATION REPORT
=====================================
Case ID: INC-2025-1547
Evidence: EVD-001 (Samsung 870 EVO 500GB SSD)
Examiner: [Name]
Date of Analysis: 2025-11-16
EVIDENCE INTEGRITY
Source Hash: SHA-256: a1b2c3d4e5f6...
Image Hash: SHA-256: a1b2c3d4e5f6... (VERIFIED MATCH)
Write Blocker: Tableau T35u
PARTITION LAYOUT
Partition 1: NTFS 100 MB (System Reserved)
Partition 2: NTFS 465 GB (C: - OS and Data)
Partition 3: NTFS 500 MB (Recovery)
KEY FINDINGS
1. [Timestamp] - Malware dropper created in %TEMP% (update.exe)
2. [Timestamp] - Scheduled task "WindowsUpdate" created for persistence
3. [Timestamp] - Prefetch shows 14 executions of update.exe
4. [Timestamp] - USB device "Kingston DataTraveler" connected
5. [Timestamp] - 847 files copied to E:\ drive (ShellBag evidence)
RECOVERED ARTIFACTS
- 3 deleted malware samples recovered from unallocated space
- Browser history showing C2 panel access
- Registry evidence of disabled security software
TIMELINE
[Chronological event listing with timestamps and evidence sources]
TOOLS USED
- FTK Imager 4.7.1 (imaging)
- Autopsy 4.21.0 (analysis)
- PECmd 1.5.0 (prefetch parsing)
- MFTECmd 1.2.2 (MFT analysis)