Skill UI

Use Autopsy and Sleuth Kit to dissect disk images, recover deleted files, extract artifacts, run keyword searches, and build timelines so investigators deliver structured evidence and visual reports for cases.

Analyze Windows LNK shortcut files and Jump Lists with LECmd/JLECmd and manual Shell Link parsing to chronicle file access, program execution, and user activity for incident response and threat hunting.

Guides forensic analysts through using Volatility 3 (and legacy Volatility 2) to inspect RAM dumps, identify injected/malicious processes, dump artifacts, scan with YARA, and extract credentials or network activity from compromised systems.

Extract forensic artifacts from Outlook PST/OST files with libpff, pst-utils, and Python tools, covering message content, headers, attachments, and deleted items to support incident response and legal investigations.

Extract and examine Windows Registry hives from forensic images to reveal installed software, autorun entries, USB history, and user activity, supporting incident response or insider threat investigations with RegRipper, python-registry, and hash validation workflows.

Automates extraction and analysis of Chrome, Firefox, and Edge history, downloads, cookies, bookmarks, and cache from forensic images to reconstruct user web activity and correlate it with other investigation timelines.

Guides the capture and analysis of volatile and persistent data on compromised endpoints, covering memory acquisition, disk imaging, artifact parsing, and timeline reconstruction for incident response and legal evidence.