How to use the MFT Deleted File Recovery agent skill

What is an agent skill and what does this one do?

An agent skill is a folder of instructions and supporting files that an AI agent can load when a task matches the skill's description. This skill is for digital forensics and incident response work on Windows disk images. It guides the agent through reading the NTFS Master File Table ($MFT), which holds metadata for every file and directory on an NTFS volume.

When a file is deleted, its MFT record is marked inactive (the InUse flag is cleared), but the metadata usually remains until a new file reuses that entry. The skill also covers the USN Journal ($UsnJrnl:$J), the $LogFile, and MFT slack space, and correlating these with Recycle Bin artifacts.

• Parse the MFT with MFTECmd or analyzeMFT and look for records where InUse is False.
• Review USN Journal entries for deletion, rename and close events.
• Check $LogFile transactions for deallocation operations.
• Compare $STANDARD_INFORMATION and $FILE_NAME timestamps to look for possible timestomping.
• Match Recycle Bin $I and $R files back to MFT entries.

Install the skill (download, unzip, or upload)

Download the ZIP for this skill from this page. Unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only inside that project.

If you use the Claude apps instead of a local setup, upload the skill under Settings → Capabilities → Skills.

The skill folder contains SKILL.md (the main instructions), references/ (API reference, standards and workflows), assets/template.md (a report template), and scripts/ (agent.py and process.py).

Check the requirements before you start

The skill assumes you already have the forensic tools and evidence. It does not supply them. Confirm the following are available before you ask the agent to work on a case.

• Python 3.8 or newer, for the custom analysis scripts.
• MFTECmd (Eric Zimmerman) or analyzeMFT, to produce CSV output from the $MFT.
• A forensic disk image in E01, raw/dd, VMDK or VHDX format.
• FTK Imager, Arsenal Image Mounter or a similar tool for mounting the image.
• Timeline Explorer or Excel for viewing CSV output (optional).
• LogFileParser and RBCmd, which the workflow references.

Trigger the skill with natural requests

You do not need a special command. Describe the task in plain language that matches the skill's purpose, such as recovering evidence of deleted files, rebuilding an NTFS timeline, or checking for timestomping. The agent should load the skill when the request fits its description.

Give the agent the location of your evidence and the output folder, and say what you want to know. Results are more useful when you name the artifact (for example, the MFT or the USN Journal).

• Look at the $MFT from this image in the evidence folder and list deleted records that have a parent path in Users.
• Parse the $J file with MFTECmd and tell me which entries show file deletion.
• Check the MFT for timestomping by comparing $SI and $FN created times.
• Use the report template to summarise the deleted files I find.

Understand the outputs and what they mean

The skill treats the InUse column as the main first filter. InUse = False marks a deleted or reallocated record. ParentPath shows where the file was before deletion, and FileSize shows the original size, which may still be recoverable. Timestamps in $STANDARD_INFORMATION and $FILE_NAME persist after deletion, so differences between them can point to tampering.

The assets/template.md file gives you a structured report with case information, summary statistics, deleted files of interest, and a timestomping indicators table. Treat the agent's findings as leads to verify, not as a final conclusion.

Safety notes: scripts, network and authorization

This skill runs scripts (scripts/agent.py and scripts/process.py), so review them before you run them on your system. The skill does not use the network. process.py reads MFTECmd CSV output to flag deleted entries and possible timestomping.

Use this skill only on disk images you are authorized to examine. The source describes this as evidence-handling work that can raise legal and privacy issues. Do not use it on live production systems. For non-forensic recovery from a healthy drive, ordinary recovery tools are simpler and safer.

• Confirm you have authorization for the disk image and follow your case's evidence-handling rules.
• Work on copies or read-only images where possible.
• Keep the original image hash (the template has a field for SHA-256).

Tips for better results

Give the agent the exact artifact and output folder. Ask for one artifact at a time (the MFT, then the USN Journal, then $LogFile) so each set of findings is easy to check. Cross-check any timestomping result against the other artifacts before you report it.

The source also mentions correlating with Volume Shadow Copies by listing shadows with vssadmin and comparing MFT records across them. Ask the agent to do this when you need to see how a file changed over time.

• Start with the InUse = False filter, then widen the search.
• Use the references/workflows.md steps as the order of work.
• Record which tool and version produced each CSV, since outputs differ between parsers.