mukul975/Anthropic-Cybersecurity-Skills
analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.
Before you install
- Last update
- Files in folder
- 4
- Scripts
- Contains scripts. Review them before running.
- SKILL.md size
- 11 KB (about 2,690 tokens of context each time it loads)
- License
- Apache-2.0
- Source on GitHub
- mukul975/Anthropic-Cybersecurity-Skills
Skills are plain text instructions the agent follows, sometimes with scripts. Check the source, prefer repositories with many installs and stars, and read any script it ships.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills@analyzing-disk-image-with-autopsyRuns in a terminal with Node.js 18 or newer. Add -y to skip the prompts and -g to install for every project instead of this one.
Install for your agent
npx skills add mukul975/Anthropic-Cybersecurity-Skills@analyzing-disk-image-with-autopsy --agent claude-code -y- Project install writes to
.claude/skills/analyzing-disk-image-with-autopsy- Global install writes to
~/.claude/skills/analyzing-disk-image-with-autopsy
Start a new session afterwards so the agent picks the skill up. In Claude Code you can also call it directly with /analyzing-disk-image-with-autopsy.
What it does
Analyzing Disk Image with Autopsy When to Use - When you have a forensic disk image and need structured analysis of its contents - During investigations requiring file recovery, keyword searching, and timeline analysis - When non-technical stakeholders need visual reports from forensic evidence - For examining file system metadata, deleted files, and embedded artifacts - When building a comprehensive case from multiple disk images Prerequisites - Autopsy 4.x installed (Windows) or Autopsy 4.x with The Sleuth Kit (Linux) - Forensic disk image in raw (dd), E01 (EnCase), or AFF format - Minimum…
Excerpt from the skill's own SKILL.md. Read the full file on GitHub before installing: skills run with your agent's permissions.
Categories
Related skills
- analyzing-api-gateway-access-logs
mukul975/Anthropic-Cybersecurity-Skills
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
- acquiring-disk-image-with-dd-and-dcfldd
mukul975/Anthropic-Cybersecurity-Skills
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
664 installs 35K scripts - analyzing-android-malware-with-apktool
mukul975/Anthropic-Cybersecurity-Skills
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
- analyzing-email-headers-for-phishing-investigation
mukul975/Anthropic-Cybersecurity-Skills
Parse and analyze email headers (Received chain, Return-Path, Message-ID)
604 installs 35K scripts - analyzing-cyber-kill-chain
mukul975/Anthropic-Cybersecurity-Skills
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain
600 installs 35K scripts - analyzing-browser-forensics-with-hindsight
mukul975/Anthropic-Cybersecurity-Skills
Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.