Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Analyzing Disk Image with Autopsy · mukul975 | DecimalAI

securityby mukul975

Analyzing Disk Image with Autopsy

analyzing-disk-image-with-autopsy

Source mukul975/Anthropic-Cybersecurity-Skills ↗License Apache-2.0

Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.

SkillScore23Maintained

Automatic

Security & AppSec pack

Last verified 7/27/2026

What it changes

Passed 5 of 22 test cases with the skill, and 3 of 22 without it.

Without skill14%

With skill23%

2 fixed3 passed either way17 still failing0 broke

Pass-rate lift: +9 pp
Tokens: +154%
Agent turns: 0%
Response time: -24%

Model gemini-3.6-flashMeasured 7/27/2026v15 of 22 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/analyzing-disk-image-with-autopsy/SKILL.md https://app.decimal.ai/s/analyzing-disk-image-with-autopsy/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add analyzing-disk-image-with-autopsy, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/analyzing-disk-image-with-autopsy/ and pins it in .decimal/skills.lock

decimalai skills add analyzing-disk-image-with-autopsy

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-disk-image-with-autopsy/SKILL.md https://app.decimal.ai/s/analyzing-disk-image-with-autopsy/SKILL.md

Raw file: /s/analyzing-disk-image-with-autopsy/SKILL.md ↗ · machine-readable summary at /s/analyzing-disk-image-with-autopsy.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

What's inside

The instructions your model reads when the skill loads.

SKILL.md241 lines3 filesincludes scripts

Analyzing Disk Image with Autopsy

When to Use

When you have a forensic disk image and need structured analysis of its contents
During investigations requiring file recovery, keyword searching, and timeline analysis
When non-technical stakeholders need visual reports from forensic evidence
For examining file system metadata, deleted files, and embedded artifacts
When building a comprehensive case from multiple disk images

Prerequisites

Autopsy 4.x installed (Windows) or Autopsy 4.x with The Sleuth Kit (Linux)
Forensic disk image in raw (dd), E01 (EnCase), or AFF format
Minimum 8GB RAM (16GB recommended for large images)
Java Runtime Environment (JRE) 8+ for Autopsy
Sufficient disk space for the Autopsy case database (2-3x image size)
Hash databases (NSRL, known-bad hashes) for file identification

Workflow

Step 1: Install Autopsy and Configure Environment

# On Linux, install Sleuth Kit and Autopsy
sudo apt-get install autopsy sleuthkit

# Download Autopsy 4.x (GUI version) from official source
wget https://github.com/sleuthkit/autopsy/releases/download/autopsy-4.21.0/autopsy-4.21.0.zip
unzip autopsy-4.21.0.zip -d /opt/autopsy

# On Windows, run the MSI installer from sleuthkit.org
# Launch Autopsy
/opt/autopsy/bin/autopsy --nosplash

# For Sleuth Kit command-line analysis alongside Autopsy
sudo apt-get install sleuthkit

Step 2: Create a New Case and Add the Disk Image

Track record

Benchmark

5 / 22

test cases passed, vs 3 / 22 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-disk-image-with-autopsy/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

performing-disk-forensics-investigationConducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases. Utilizes tools such as FTK Imager, Autopsy, and The Sleuth Kit for evidence acquisition, deleted file recovery, and artifact examination. Activates for requests involving disk forensics, hard drive analysis, forensic imaging, file recovery, evidence acquisition, or digital forensic investigation.Close match+5 pp pass-rate lift

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

What's inside

Analyzing Disk Image with Autopsy

When to Use

Prerequisites

Workflow

Step 1: Install Autopsy and Configure Environment

Step 2: Create a New Case and Add the Disk Image

Track record

Benchmark

Adoption

SkillSafety

Source

Other skills for the same job

Related skills