forensics

majiayu000's avatarfrom majiayu000

Extracts hidden data from files and analyzes forensic artifacts. Use when working with images, memory dumps, disk images, steganography, file carving, or when searching for hidden flags in files.

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 5, 2026⬇️1downloads
[Security Operations]

When & Why to Use This Skill

The Forensics Analysis skill enables Claude to perform deep digital investigations and data extraction. It specializes in uncovering hidden information within files, analyzing memory dumps, and performing steganography checks. By automating industry-standard tools like binwalk, exiftool, and volatility, it streamlines the process of identifying forensic artifacts, carving embedded data, and solving complex cybersecurity challenges.

Use Cases

  • Cybersecurity Incident Response: Analyzing memory dumps and disk images to identify malicious processes, unauthorized access, or signs of compromise.
  • Capture The Flag (CTF) Challenges: Automating the search for hidden flags in images, network captures, or corrupted files using multi-step forensic workflows.
  • Steganography Analysis: Detecting and extracting hidden messages or data embedded within image and audio files using LSB and brute-force techniques.
  • Data Recovery and File Carving: Investigating corrupted or unknown file types to extract embedded objects and restore hidden content from disk images.
nameforensics
descriptionExtracts hidden data from files and analyzes forensic artifacts. Use when working with images, memory dumps, disk images, steganography, file carving, or when searching for hidden flags in files.
allowed-toolsBash, Read, Write, Grep, Glob

Forensics Analysis Skill

Quick Workflow

Progress:
- [ ] Identify file type (file, xxd)
- [ ] Check metadata (exiftool)
- [ ] Search strings for flag
- [ ] Check for embedded data (binwalk)
- [ ] Try steganography tools
- [ ] Extract hidden content

Step 1: Quick Analysis

file suspicious_file
exiftool suspicious_file
strings suspicious_file | grep -iE "flag|ctf|secret|key"
binwalk suspicious_file

Step 2: Identify Challenge Type

File Type Approach Reference
Image (PNG/JPG) Steganography reference/steganography.md
Memory dump Volatility reference/memory.md
Unknown/corrupted File analysis reference/file-analysis.md
PCAP Network skill Use networking skill

Image Stego - Quick Start

# Try AperiSolve first (online)
# https://www.aperisolve.com/

# PNG
zsteg image.png
zsteg -a image.png

# JPEG
steghide extract -sf image.jpg
stegseek image.jpg rockyou.txt  # Brute force

Full techniques: reference/steganography.md

Memory Dump - Quick Start

# Volatility 3
vol -f memory.dmp windows.info
vol -f memory.dmp windows.pslist
vol -f memory.dmp windows.filescan | grep -i flag

Full techniques: reference/memory.md

File Carving - Quick Start

binwalk -e suspicious_file      # Extract embedded files
foremost -i file -o output/     # Carve files

# Fix corrupted header
xxd file | head -10             # Check magic bytes

Full techniques: reference/file-analysis.md

Online Tools

Tool URL Purpose
AperiSolve aperisolve.com All-in-one stego
StegOnline stegonline.georgeom.net Image analysis
CyberChef gchq.github.io/CyberChef Data transform

Reference Files