Skill UI

Standardized expert guidance for return authorization, inspection, grading, disposition decisions, refunds, fraud detection, and vendor recovery in retail and e-commerce operations.

This skill details advanced digital forensics techniques for recovering metadata and content of deleted files by analyzing the NTFS Master File Table ($MFT). It covers examining key system artifacts like $LogFile and $UsnJrnl, and analyzing MFT slack space. Use this when reconstructing file system timelines, investigating data loss, or detecting anti-forensic techniques like timestomping during a Windows forensic examination.

This skill analyzes the cryptographic algorithms, key management systems, and file encryption routines employed by various ransomware families. It covers hybrid schemes like AES-RSA and modern ciphers such as ChaCha20. Use this when assessing data recovery feasibility, reverse engineering ransomware binaries, identifying implementation weaknesses (e.g., IV reuse, key derivation flaws), or developing custom decryptor tools.

A comprehensive method for deep forensic analysis of NTFS disk images. It examines critical artifacts such as the Master File Table (MFT), USN Change Journal, Alternate Data Streams (ADS), and unallocated slack space. This is essential for recovering deleted file metadata, detecting hidden data, and reconstructing file system activities when standard recovery tools are insufficient.

A comprehensive, structured playbook for Security Operations Centers (SOCs) detailing the entire lifecycle of ransomware incidents. It guides analysts through detection (SIEM queries), triage decision trees, containment (EDR/Firewall), evidence collection, and recovery phases, adhering to NIST CSF and MITRE ATT&CK frameworks.

A comprehensive, multi-stage framework for responding to confirmed or suspected malware infections across an enterprise. This guide covers the entire incident lifecycle: detection, scoping, containment, deep analysis (mapping to MITRE ATT&CK), thorough eradication, and system recovery, ensuring all steps are documented for resilience and compliance.

A comprehensive guide for security professionals to proactively hunt for Indicators of Compromise related to Volume Shadow Copy deletion (T1490). This technique is critical for detecting ransomware preparation and anti-forensics activity. It details using SIEM/EDR platforms to query for specific commands (vssadmin, wmic, PowerShell) associated with deleting system recovery points and shadow copies.

This guide details the implementation of a robust, ransomware-resilient backup architecture following the extended 3-2-1-1-0 rule. It covers critical steps such as classifying assets, defining RPO/RTO, implementing immutable or air-gapped storage, and isolating backup credentials from the production domain. Use this knowledge to design a multilayered defense against data loss and ensure reliable recovery points.

A comprehensive guide and workflow for digital forensic investigators to analyze ransomware artifacts. This process involves preserving volatile evidence (memory dumps), identifying the ransomware variant from file extensions and ransom notes, establishing the attack timeline using Prefetch and Event Logs, and extracting critical Indicators of Compromise (IoCs) such as Bitcoin addresses and Tor sites. Essential for incident response and recovery planning.

Guide for executing a structured ransomware incident response covering detection, containment, eradication, backup recovery, and post-recovery validation, ensuring teams with IR plans and segmented networks can act swiftly.

Provides a structured, comprehensive playbook for managing high-impact ransomware incidents. It guides the response team through initial detection, immediate network containment, detailed damage assessment, recovery decision making (including legal and financial considerations), and secure system restoration. Essential for cybersecurity teams facing active encryption attacks.

A comprehensive guide and workflow for recovering deleted files (documents, images, videos, etc.) from damaged storage media, forensic disk images, or corrupted file systems. It utilizes PhotoRec's file signature-based carving engine, allowing data recovery regardless of file system damage. The process includes advanced steps for file validation, hashing, and organizing evidence for forensic analysis.