mukul975/Anthropic-Cybersecurity-Skills
acquiring-disk-image-with-dd-and-dcfldd
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
Before you install
- Last update
- Files in folder
- 4
- Scripts
- Contains scripts. Review them before running.
- SKILL.md size
- 8.6 KB (about 2,200 tokens of context each time it loads)
- License
- Apache-2.0
- Source on GitHub
- mukul975/Anthropic-Cybersecurity-Skills
Skills are plain text instructions the agent follows, sometimes with scripts. Check the source, prefer repositories with many installs and stars, and read any script it ships.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills@acquiring-disk-image-with-dd-and-dcflddRuns in a terminal with Node.js 18 or newer. Add -y to skip the prompts and -g to install for every project instead of this one.
Install for your agent
npx skills add mukul975/Anthropic-Cybersecurity-Skills@acquiring-disk-image-with-dd-and-dcfldd --agent claude-code -y- Project install writes to
.claude/skills/acquiring-disk-image-with-dd-and-dcfldd- Global install writes to
~/.claude/skills/acquiring-disk-image-with-dd-and-dcfldd
Start a new session afterwards so the agent picks the skill up. In Claude Code you can also call it directly with /acquiring-disk-image-with-dd-and-dcfldd.
What it does
Acquiring Disk Image with dd and dcfldd When to Use - When you need to create a forensic copy of a suspect drive for investigation - During incident response when preserving volatile disk evidence before analysis - When law enforcement or legal proceedings require a verified bit-for-bit copy - Before performing any destructive analysis on a storage device - When acquiring images from physical drives, USB devices, or memory cards Prerequisites - Linux-based forensic workstation (SIFT, Kali, or any Linux distro) - dd (pre-installed on all Linux systems) or dcfldd (enhanced forensic version) -…
Excerpt from the skill's own SKILL.md. Read the full file on GitHub before installing: skills run with your agent's permissions.
Related skills
- analyzing-api-gateway-access-logs
mukul975/Anthropic-Cybersecurity-Skills
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
- analyzing-android-malware-with-apktool
mukul975/Anthropic-Cybersecurity-Skills
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
- analyzing-email-headers-for-phishing-investigation
mukul975/Anthropic-Cybersecurity-Skills
Parse and analyze email headers (Received chain, Return-Path, Message-ID)
604 installs 35K scripts - analyzing-cyber-kill-chain
mukul975/Anthropic-Cybersecurity-Skills
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain
600 installs 35K scripts - analyzing-browser-forensics-with-hindsight
mukul975/Anthropic-Cybersecurity-Skills
Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
- analyzing-docker-container-forensics
mukul975/Anthropic-Cybersecurity-Skills
Investigate compromised Docker containers by analyzing images, layers,