Skill UI

Guides responders through detecting, containing, and investigating AWS/Azure/GCP compromises by centralizing log analysis, isolating identities/resources, and preserving forensic evidence for fast cloud incident recovery.

Use PhotoRec to carve deleted documents, images, videos, and database files from forensic disk images or damaged storage media when metadata is missing; the workflow covers installation, interactive scans, command-mode targeting, cataloging, and validation for evidence-focused investigations.