Skill UI

This skill details the forensic analysis of Windows LNK shortcut files and Jump Lists. These artifacts record critical user activity, including file access and program execution, even after the original source files have been deleted. It covers using specialized tools (LECmd, JLECmd) and Python parsing techniques to reconstruct user timelines, making it essential for incident response and deep digital forensics examinations.

Walks through analyzing RAM dumps with Volatility 3/2 to uncover injected code, hidden processes, network activity, and credentials when responding to compromised hosts.

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.

This skill details advanced digital forensics techniques for recovering metadata and content of deleted files by analyzing the NTFS Master File Table ($MFT). It covers examining key system artifacts like $LogFile and $UsnJrnl, and analyzing MFT slack space. Use this when reconstructing file system timelines, investigating data loss, or detecting anti-forensic techniques like timestomping during a Windows forensic examination.

Utilize the Scapy library in Python to perform deep packet inspection, crafting, sending, and sniffing of various network protocols (TCP, UDP, ICMP, DNS). This skill is essential for analyzing pcap files, implementing advanced security techniques like SYN scans, extracting protocol fields, and detecting network anomalies such as fragmentation or tunneling indicators. Ideal for security researchers, SOC analysts, and penetration testers.

A comprehensive guide for deep packet inspection and network forensics using Wireshark and tshark. This skill is critical for incident response, where it allows users to capture, filter, and analyze network packet data to identify malicious command-and-control traffic, diagnose complex protocol issues, extract indicators of compromise (IOCs), and reconstruct data exfiltration paths. Use it for validating security rules and understanding network anomalies.

A comprehensive toolset for digital forensics investigators, enabling the parsing of proprietary Microsoft Outlook PST and OST files. It extracts critical evidence including full message content, detailed email headers (for message routing/tracing), attachments, and deleted items from the Recoverable Items folder. Essential for e-discovery, legal investigations, and security incident response to reconstruct communication patterns and analyze message metadata.

This tool is designed for advanced threat hunting and digital forensics. It analyzes Windows Event Logs (specifically Script Block Logging 4104 and Module Logging 4103) to detect artifacts left by the PowerShell Empire post-exploitation framework. Detection patterns include default launchers, Base64 payloads (WebClient, FromBase64String), known module invocations (e.g., Invoke-Mimikatz), and staging URL patterns, helping confirm C2 activity and lateral movement.

This skill guides the process of analyzing Windows Prefetch (.pf) files to reconstruct a detailed program execution history. By parsing these system artifacts, users can determine which applications were run, how many times, and when. It is crucial for building forensic timelines, confirming suspicious binary execution during malware investigations, and localizing evidence in a Windows system.

This tool correlates multiple system artifacts, including Windows registry keys (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs, to reconstruct a detailed timeline of USB device usage. It determines first/last connection timestamps, tracks device provenance, and maps drive letter assignments. Essential for digital forensics investigations, insider threat detection, and verifying compliance regarding removable media usage.

This skill parses Windows Prefetch (.pf) files to reconstruct detailed application execution history. It is crucial for digital forensics, allowing analysts to track execution timelines, identify suspicious or renamed binaries, and investigate potential malware activity or lateral movement during incident response. It uses Python to extract run counts and accessed file details.

This comprehensive guide details the systematic extraction and analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) from forensic images. It demonstrates how to use specialized tools like RegRipper and Python scripts to uncover critical artifacts, including user activity history, persistence mechanisms (autorun keys), installed software records, and evidence of system compromise, which is crucial for digital forensics investigations.