Skill UI

This skill details advanced digital forensics techniques for recovering metadata and content of deleted files by analyzing the NTFS Master File Table ($MFT). It covers examining key system artifacts like $LogFile and $UsnJrnl, and analyzing MFT slack space. Use this when reconstructing file system timelines, investigating data loss, or detecting anti-forensic techniques like timestomping during a Windows forensic examination.

A comprehensive method for deep forensic analysis of NTFS disk images. It examines critical artifacts such as the Master File Table (MFT), USN Change Journal, Alternate Data Streams (ADS), and unallocated slack space. This is essential for recovering deleted file metadata, detecting hidden data, and reconstructing file system activities when standard recovery tools are insufficient.

This skill guides the detection and recovery of exposed version-control system (VCS) metadata, including paths for Git, SVN, and Mercurial, as well as common backup and configuration files. It is essential for authorized penetration testing when assessing an application's security posture against information leaks. Techniques include probing specific directories (e.g., /.git/HEAD) and analyzing status codes (e.g., 403 vs 404) to confirm exposure.

This specialized skill provides a deep workflow for reverse engineering stripped Go and Rust binaries. It guides the recovery of lost runtime metadata, including symbols, pclntab data, and panic strings. The process addresses language-specific challenges, such as Go's interface structures and Rust's complex async state machines, serving as a crucial complement to general decompilers like IDA or Ghidra.

Reverse engineer stripped Go and Rust binaries: runtime recognition, pclntab/module metadata recovery, panic-string analysis, and idiomatic decompilation strategies.