How to use the Autopsy disk image analysis agent skill

What the skill makes the agent do

Once installed, the agent can walk you through a digital forensics workflow on a disk image. The skill covers checking partitions, listing and recovering deleted files, searching for keywords and file signatures, and building timelines and HTML reports in Autopsy.

The skill also includes a small Python helper (scripts/agent.py) that runs Sleuth Kit command-line tools on an image and parses their output. A reference file (references/api-reference.md) documents the Sleuth Kit commands and flags the skill uses.

• Partition layout checks with mmls
• File listing, including deleted entries, with fls
• Recovery of deleted files with icat and tsk_recover
• Keyword and file signature searches with srch_strings and sigfind
• Timelines with fls bodyfile output and mactime
• Visual reports from Autopsy

How do you install the skill?

Download the skill ZIP from this page. You can install it in one of two ways depending on how you use your agent.

For Claude Code, unzip the file into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only for that project. The skill folder should contain SKILL.md, scripts/ and references/.

In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

What tools and hardware do you need first?

The skill assumes Autopsy, The Sleuth Kit and any large hash sets are already installed and configured. It is not a one-click tool. Check these requirements before you start a real analysis.

The source lists Autopsy 4.x (GUI) and the Sleuth Kit command-line tools img_stat, mmls, fls, icat, istat, tsk_recover, srch_strings, sigfind and mactime. You also need Java Runtime Environment 8 or newer and Python 3 for the bundled script.

Plan for at least 8GB RAM (16GB recommended) and disk space of 2 to 3 times the image size for the Autopsy case database. The NSRL hash set from NIST is optional and is used for known-good filtering.

• Autopsy 4.x (GUI) and The Sleuth Kit command-line tools
• Java Runtime Environment 8+
• Python 3 for scripts/agent.py
• At least 8GB RAM, 16GB recommended
• Free disk space of 2-3x the image size
• NSRL hash set from NIST (optional)

How do you trigger the skill with a natural request?

You do not need special syntax. The skill's description says it applies to structured analysis of a forensic disk image, or when stakeholders need visual reports from evidence. Name the image and the goal in plain language, and say that you are authorized to examine it.

Good requests state the file, the format and what you want to find or produce. Vague requests like 'look at this drive' are less likely to lead to a focused workflow.

• "I have an authorized E01 image at /cases/case-01/images/evidence.E01. List the partitions and tell me what to check first."
• "Find deleted files on this raw dd image and recover any Office documents to a recovered folder."
• "Build a timeline for January 15 to 20 from this image so I can review file activity in that window."
• "Help me make an HTML report with tagged keyword hits for my non-technical client."

What does a typical analysis look like?

The workflow follows the order an examiner would use. Confirm the image and its partitions first, then recover and search, then build the timeline and report. The commands below are from the skill's Sleuth Kit examples; replace the paths and the partition offset (2048 in the examples) with values from your own mmls output.

In Autopsy, the skill describes creating a new case, adding the image as a 'Disk Image or VM File' data source, selecting the time zone of the original system and enabling ingest modules such as Hash Lookup, Keyword Search and File Type Identification. Keyword work covers ad hoc searches, tagging results and adding comments. Reports are generated as HTML from tagged items and chosen data sources.

• Verify the image and list partitions
• Recover deleted files and check metadata
• Run keyword searches and tag evidence
• Build a timeline for the incident window
• Generate an HTML report

What safety and privacy points should you know?

This skill runs scripts. The bundled scripts/agent.py executes Sleuth Kit command-line tools on the image you point it at. Review the script before you run it on evidence, and run it on a working copy where your procedures require that.

The skill uses the network. The source's install steps download Autopsy, and its hash set step downloads the NSRL from NIST. Check those sources yourself before running the downloads.

Recovering deleted files and personal data raises privacy and legal issues. Only analyze images you have legal authority to examine. The skill does not cover chain of custody, and its output is not a substitute for expert review. Production evidence needs an accredited chain-of-custody process.

• Only examine images you are legally authorized to analyze
• scripts/agent.py runs command-line tools; read it before use
• Network downloads occur for Autopsy and the optional NSRL hash set
• Not a substitute for accredited chain-of-custody or expert review

Tips for better results

Give the agent the exact image path and format, and state the time zone of the original system. Timelines are only useful if the time zone is right. If a partition offset is unclear, ask the agent to run mmls first and use the offset it reports.

Start with a narrow question and widen it. Keyword searches on common words return noisy results, so combine terms with tags and comments as you review hits.

• State the image format (raw dd, E01 or AFF) in your request
• Confirm the time zone before reading timelines
• Run mmls before any partition-specific command
• Use tags and comments to keep track of relevant items
• Have a qualified examiner review findings before relying on them