Skill UI

Extract forensic evidence from Outlook PST/OST archives using libpff-based tooling and Python scripts to recover deleted items, headers, attachments, and metadata for incident response and legal investigations.

Guides responders through collecting memory, network, and process snapshots from compromised hosts before volatility is lost, ensuring chain-of-custody and supporting incident response plus legal follow-up.

Performs full disk forensic imaging and analysis using FTK Imager, Autopsy, Sleuth Kit, and related utilities to recover deleted data, verify evidence integrity, and rebuild user or adversary timelines for incident response and legal investigations.

Guides the capture and analysis of volatile and persistent data on compromised endpoints, covering memory acquisition, disk imaging, artifact parsing, and timeline reconstruction for incident response and legal evidence.

Performs comprehensive investigations into insider threat incidents by pairing digital forensics, user behavior analytics, and HR/legal coordination to validate allegations, collect covert evidence, and support security actions when employees or trusted partners misuse privileged access.

Guides structured ransomware response from detection through containment, assessment, recovery and post-incident hardening, covering negotiation, legal checks, backup validation, and recovery planning.