Skill UI

This guide details advanced digital forensics techniques for recovering deleted file metadata and content from NTFS volumes. It focuses on analyzing the Master File Table (MFT), USN Journals, and $LogFile transaction records. Techniques include parsing MFT slack space and utilizing specialized tools like MFTECmd to reconstruct file system timelines and identify deleted evidence remnants.

A comprehensive guide for deep packet inspection and network forensics using Wireshark and tshark. This skill is critical for incident response, where it allows users to capture, filter, and analyze network packet data to identify malicious command-and-control traffic, diagnose complex protocol issues, extract indicators of compromise (IOCs), and reconstruct data exfiltration paths. Use it for validating security rules and understanding network anomalies.

This tool provides comprehensive forensic analysis for Microsoft Outlook PST and OST files. It extracts critical evidence such as message content, detailed headers, attachments, and deleted items using open-source libraries like libpff and Python, supporting legal investigations and incident response.

This guide provides a comprehensive workflow for deep digital forensics examination of NTFS volumes. It covers recovering hidden data from file system slack space, analyzing MFT entries for deleted metadata, reconstructing file actions using the USN Journal, and detecting hidden content via Alternate Data Streams (ADS). Essential for incident response and evidence recovery.

A comprehensive digital forensics technique used to investigate removable media usage. It parses artifacts from Windows registry (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs to track which USB devices were connected, when they were used, and establishing a timeline for potential data exfiltration or insider threat activity.

A specialized tool for digital forensics investigators that parses the Windows Amcache.hve registry hive. It extracts crucial evidence regarding program execution history, application installation metadata, and loaded driver binaries. By correlating SHA-1 hashes and reconstructing timelines, users can determine which executables ran on a system, aiding in incident response and threat detection.

This skill provides a method to parse Windows Prefetch files (.pf) using Python, allowing security analysts to reconstruct detailed application execution histories. It is crucial for incident response, enabling the detection of renamed binaries, identifying suspicious execution patterns, and building accurate chronological timelines of system activity for deep forensic investigation.

This comprehensive forensic workflow guides investigators through the extraction and detailed analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, etc.). It is used during incident response to uncover critical artifacts, including user activity history, malware persistence mechanisms (autorun keys), installed software records, and evidence of system compromise.

Shellbags are critical Windows registry artifacts that record user interaction history with directories, storing view settings and browsing paths. This toolset allows analysts to reconstruct folder access history, detect connections to removable media, and prove navigation to network shares, even if the original folders no longer exist on the system. Essential for digital forensics and incident response.

This guide details the comprehensive workflow for conducting memory forensics using Volatility 3. It covers the entire incident response lifecycle, from acquiring raw RAM dumps to analyzing processes, detecting rootkits, investigating network connections, and extracting sensitive artifacts like credentials and injected code. Essential for live memory analysis in cybersecurity investigations.

A comprehensive guide and methodology for detecting process hollowing (T1055.012). It involves advanced memory forensics, analyzing memory-mapped sections, and correlating parent-child process anomalies using EDR and Sysmon data to identify fileless and in-memory malware threats.

A comprehensive skill for detecting advanced malware techniques, including DLL injection, process hollowing, APC injection, and thread hijacking. Utilizes memory forensics (Volatility), API monitoring (Sysmon), and behavioral analysis to identify malicious code artifacts and suspicious process activities in a deep defense context.