13 skills · sorted by relevance
Investigate memory dumps, disk records, and captured network traffic while preserving evidence. The skill guides timeline reconstruction and examination of system traces to identify suspicious activity and produce findings that others can review.
Reconstruct activity on a compromised computer by combining file timestamps, event logs, browser history, and other evidence into one timeline. Extract and filter events with Plaso, then review and annotate them collaboratively in Timesketch.
Analyze Windows Prefetch files, which record application execution data, using Python. Reconstruct execution timelines, review run counts and accessed resources, and identify suspicious programs or signs that an executable has been renamed to disguise its identity.
Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
The English summary is being prepared. Showing the original description.
Conducts digital forensics investigations following a personal data breach, covering evidence preservation, chain of custody documentation, log analysis, scope determination, and root cause analysis. References industry-standard tools including Splunk, ELK Stack, and Wireshark. Provides forensic workflow from initial evidence collection through final investigation report. Keywords: digital forensics, breach investigation, evidence preservation, chain of custody, root cause analysis, Splunk, ELK, Wireshark.
The English summary is being prepared. Showing the original description.
Use when a task needs the judgment of a Digital Forensics Analyst — capturing volatile evidence before it's lost, creating and hash-verifying a forensic disk image, documenting chain of custody from point of seizure, correcting for clock skew and timezone mismatches when building a cross-source timeline, or identifying anti-forensic activity (log wiping, timestomping) in an investigation.
The English summary is being prepared. Showing the original description.
Generate log2timeline and Plaso super-timelines and triage them in Timesketch.
The English summary is being prepared. Showing the original description.
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
The English summary is being prepared. Showing the original description.
Digital forensics v3 — disk imaging, memory analysis, network forensics, chain of custody, legal
The English summary is being prepared. Showing the original description.
Expert en forensique numérique avancée (disk imaging, memory analysis, network forensics, reporting, chain of custody, incident response)
The English summary is being prepared. Showing the original description.
Expert en forensique numérique (disk imaging, memory analysis, network forensics, chain of custody)
The English summary is being prepared. Showing the original description.
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
The English summary is being prepared. Showing the original description.
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
The English summary is being prepared. Showing the original description.