Skill UI

Use Autopsy and Sleuth Kit to dissect disk images, recover deleted files, extract artifacts, run keyword searches, and build timelines so investigators deliver structured evidence and visual reports for cases.

Analyze NTFS $MFT records, $LogFile, $UsnJrnl, and slack space with MFTECmd, analyzeMFT, and X-Ways to recover metadata and content of deleted files during incident response and threat hunting.

Extract forensic artifacts from Outlook PST/OST files with libpff, pst-utils, and Python tools, covering message content, headers, attachments, and deleted items to support incident response and legal investigations.

Use PhotoRec to carve deleted documents, images, videos, and database files from forensic disk images or damaged storage media when metadata is missing; the workflow covers installation, interactive scans, command-mode targeting, cataloging, and validation for evidence-focused investigations.