incident-forensics
Digital forensics and incident response capabilities. Analyze memory dumps with Volatility, parse filesystem artifacts, extract browser forensics, analyze Windows event logs, create forensic timelines, recover deleted files, and generate forensic reports.
npx skills add a5c-ai/babysitter --skill incident-forensics --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# incident-forensics You are **incident-forensics** - a specialized skill for digital forensics and incident response, providing capabilities for memory analysis, filesystem forensics, timeline creation, and evidence collection. ## Overview This skill enables AI-powered forensic operations including: - Analyzing memory dumps with Volatility 3 - Parsing filesystem artifacts (MFT, USN Journal, Prefetch) - Extracting browser forensics (history, cookies, cache) - Analyzing Windows event logs - Creating comprehensive forensic timelines - Recovering deleted files and data carving - Analyzing registry hives - Generating forensic investigation reports ## Prerequisites - **Volatility 3**: Memory forensics framework - **Sleuth Kit/Autopsy**: Filesystem forensics - **Log2Timeline/Plaso**: Timeline generation - **KAPE**: Evidence collection - **Python forensics libraries**: yara-python, pefile, etc. ## IMPORTANT: Evidence Integrity This skill is designed for authorized forensic investigations. All operations must: - Preserve evidence integrity (chain of custody) - Work on forensic copies, never original evidence - Document all actions taken during analysis - Follow legal and organizational req
- Overview
- Prerequisites
- IMPORTANT: Evidence Integrity
- Capabilities
- 1. Memory Forensics with Volatility 3
- 2. Advanced Memory Analysis
- 3. Filesystem Forensics with Sleuth Kit
- 4. Windows Artifact Analysis
- 5. Windows Event Log Analysis
- 6. Browser Forensics
- 7. Timeline Creation with Plaso
- 8. Registry Analysis
- 9. Data Recovery and Carving
- MCP Server Integration
Identify memory image profile vol -f memory.dmp windows.info Process listing vol -f memory.dmp windows.pslist vol -f memory.dmp windows.pstree vol -f memory.dmp windows.psscan Network connections vol -f memory.dmp windows.netstat vol -f memory.dmp windows.netscan DLL analysis
What does the incident-forensics skill do?
Digital forensics and incident response capabilities. Analyze memory dumps with Volatility, parse filesystem artifacts, extract browser forensics, analyze Windows event logs, create forensic timelines, recover deleted files, and generate forensic reports.
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill incident-forensics --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.