Skill UI

Comprehensive digital forensic analysis guide for Linux systems. It covers the collection and examination of critical artifacts such as authentication logs, shell histories, user configurations, system files (passwd, shadow), and persistence mechanisms to effectively detect security compromises, unauthorized access, and malicious activity.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

This skill guides comprehensive digital forensics investigations on compromised endpoints. It covers evidence collection (memory acquisition, disk imaging) and deep artifact analysis, including volatile data, MFT records, and prefetch files. Use it for incident response, legal evidence collection, and determining the scope of a breach by reconstructing attacker timelines.

KAPE is a powerful, Windows-native triage tool used for Digital Forensics and Incident Response (DFIR). It executes in two phases: 'Targets' collect raw forensic artifacts (like registry hives, event logs, and prefetch files) from live systems, while 'Modules' parse this collected data into normalized, analyst-ready CSV/JSON formats. It enables fast, defensible, and scalable artifact collection, especially when full disk imaging is impractical.