Name: digital-forensics
Author: zhaoxuya520

Imported from zhaoxuya520/reverse-skill (skills/digital-forensics/SKILL.md) via skills.sh. Install upstream with npx skills add zhaoxuya520/reverse-skill --skill digital-forensics. Copyright stays with the author.

Digital Forensics & IR Artifacts

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 ../field-journal/precedent-pentest.md 或组织 IR 授权说明
NOW: 确认是取证/溯源而非进攻性扫描
NOW: 建立 case；证据只读副本优先（原始介质写保护）
NEXT: tool-index；Volatility 等常手动
ACT: 保全哈希 → 时间线 → 关键伪影

适用场景

内存转储分析（Volatility 2/3）
磁盘/ E01 / 落地文件时间线
PCAP 溯源与协议还原（可联合 protocol-reverse/）
主机伪影：Prefetch、Shimcache、Event Log、浏览器历史
应急响应 IOC 提炼（联合 malware-analysis/ / threat-hunting/）

工作流

1. 保全

□ 计算 SHA256；记录时区与采集命令
□ 工作在副本上；原始只读
□ chain of custody 备注写入 timeline

2. 内存

vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline

3. 主机伪影

□ 事件日志：Security / PowerShell / Sysmon
□ 持久化：Run 键、服务、计划任务、WMI
□ 执行痕迹：Amcache、Prefetch、BAM

4. 网络

□ tshark 统计会话与 DNS
□ 导出可疑流 → protocol-reverse 或 malware C2 分析

工具链

工具	用途
Volatility 3	内存
Timeline Explorer / Plaso	超级时间线
tshark	PCAP
Eric Zimmerman 工具集	Windows 伪影
Autopsy / FTK Imager	磁盘

参考

references/forensics-triage.md
../malware-analysis/ ../threat-hunting/ ../protocol-reverse/

路由上下文

上游: MASTER R25
下游: 恶意样本深挖 → malware-analysis；规则 → threat-hunting

任务完成自检

是否保全哈希与副本策略？
时间线是否可复核？
IOC 是否脱敏分级？
Checklist？

Install digital-forensics and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "zhaoxuya520-reverse-skill-digital-forensics", "kind": "skill", "name": "digital-forensics", "description": "Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.", "publisher": "zhaoxuya520", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/zhaoxuya520/reverse-skill", "path": "skills/digital-forensics/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/zhaoxuya520/reverse-skill/digital-forensics", "key": "zhaoxuya520/reverse-skill/skills/digital-forensics/SKILL.md" } }, "instructions": "# Digital Forensics & IR Artifacts\n\n## ACTION REQUIRED（读完后立刻执行）\n\n1. `NOW`: 读取 `../field-journal/precedent-pentest.md` 或组织 IR 授权说明\n2. `NOW`: 确认是**取证/溯源**而非进攻性扫描\n3. `NOW`: 建立 case；证据只读副本优先（原始介质写保护）\n4. `NEXT`: tool-index；Volatility 等常手动\n5. `ACT`: 保全哈希 → 时间线 → 关键伪影\n\n## 适用场景\n\n- 内存转储分析（Volatility 2/3）\n- 磁盘/ E01 / 落地文件时间线\n- PCAP 溯源与协议还原（可联合 `protocol-reverse/`）\n- 主机伪影：Prefetch、Shimcache、Event Log、浏览器历史\n- 应急响应 IOC 提炼（联合 `malware-analysis/` / `threat-hunting/`）\n\n## 工作流\n\n### 1. 保全\n\n```text\n□ 计算 SHA256；记录时区与采集命令\n□ 工作在副本上；原始只读\n□ chain of custody 备注写入 timeline\n```\n\n### 2. 内存\n\n```bash\nvol -f mem.dmp windows", "cost": { "context_tokens": 341 } }

digital-forensics

About