Skill UI

This script systematically investigates all persistence mechanisms on Windows and Linux systems. It analyzes critical areas like the Windows Registry (SYSTEM, SOFTWARE, HKCU), scheduled tasks, and common run keys to identify how malware maintains access and survives system reboots. It is essential for advanced incident response, threat hunting, and digital forensics investigations.

A comprehensive guide to analyzing volatile memory (RAM) dumps using the Volatility 3 framework. This skill enables the extraction of crucial digital evidence, including running processes, network connections, loaded modules, credentials, and encryption keys. It is essential for incident response, detecting rootkits, process hollowing, or identifying malware when traditional disk-based forensics are insufficient.

A comprehensive guide for performing deep network forensics using Wireshark and tshark. This technique analyzes raw PCAP/PCAPNG files captured during security incidents to reconstruct network events, identify data exfiltration methods, extract sensitive artifacts (credentials, files), detect Command-and-Control (C2) communications, and pinpoint network indicators of compromise (IOCs). Ideal for digital forensics and incident response teams.

A comprehensive guide and framework for performing digital forensics analysis on PCAP/PCAPNG files. This skill covers using industry-standard tools like Wireshark, tshark, tcpdump, and Python/Scapy to reconstruct network communications, extract evidence of data exfiltration, identify command-and-control (C2) activity, and trace lateral movement during incident response.

This skill performs deep forensic analysis on SQLite databases, going far beyond simple SQL queries. It is used in digital forensics and incident response to recover deleted records from freelist pages, analyze Write-Ahead Logs (WAL), and examine internal B-tree structures. It is essential for extracting critical evidence from mobile, browser, and application data sources.

A comprehensive toolset for digital forensics, designed to detect, extract, and analyze covert data hidden within images, audio, and video files. It utilizes advanced steganalysis techniques (LSB, DCT, frequency domain analysis) and specialized tools (StegDetect, zsteg, binwalk) to uncover hidden communications channels, making it crucial for investigations involving data exfiltration or insider threats.

This guide details the process of parsing Windows LNK shortcut files to extract crucial forensic artifacts. It gathers information such as target paths, MAC timestamps, volume serial numbers, and machine identifiers. This technique is invaluable in digital forensics, helping investigators reconstruct user activity timelines, track accessed files on removable media, or build comprehensive evidence from compromised systems.

A comprehensive, structured framework for conducting sophisticated Open Source Intelligence (OSINT) and cryptocurrency forensic investigations. This guide covers operational security (OpSec), target profiling, advanced transaction tracing across multiple blockchain layers (L1/L2), wallet analysis, and identifying linked digital assets. Use this methodology to guide systematic, multi-dimensional intelligence collection campaigns.

A comprehensive guide and toolkit for digital forensics experts to parse and analyze raw email headers (Received, Message-ID, etc.). This method traces the true origin of suspicious emails, validates sender authenticity by analyzing SPF, DKIM, and DMARC records, and confirms or rules out email spoofing attempts. Essential for incident response and phishing investigation.

This skill details the process of generating comprehensive forensic super-timelines using Plaso's log2timeline tools. It fuses diverse artifacts—including file-system MACB times, registry data, EVTX, and browser histories—into a single, normalized chronological view. This is critical for reconstructing the full sequence of events on compromised or forensically imaged systems during Digital Forensics and Incident Response (DFIR) investigations, helping analysts detect anti-forensic activity.

Velociraptor is a powerful open-source platform for endpoint visibility and digital forensics. It allows users to deploy agents across thousands of endpoints and execute sophisticated VQL (Velociraptor Query Language) queries. This enables large-scale, on-demand forensic artifact collection, TTP hunting, and continuous monitoring during incident response, even on air-gapped or unmanaged systems.

This guide details the process of parsing core Windows forensic artifacts, including MFT, Prefetch, Registry hives, ShellBags, and Amcache. Utilizing Eric Zimmerman's specialized EZ Tools, raw evidence is converted into standardized CSV/JSON formats. This process is crucial for Digital Forensics and Incident Response (DFIR) investigations, enabling analysts to reconstruct program execution, file access history, and persistence mechanisms, which can then be loaded into Timeline Explorer for unified analysis.