How to use the NTFS Slack Space Forensics agent skill

What the skill makes the agent do

An agent skill is a folder of instructions and helper files that Claude can load when a task matches its description. This one applies when a standard file recovery is not enough and you need to look inside an NTFS image's internal records.

The skill has the agent work through four areas. The Master File Table (MFT) lists files and their metadata, including deleted ones. The USN Change Journal is a log of file changes. Slack space is unused space left at the end of a file's last cluster or sector. Alternate Data Streams (ADS) are extra hidden data attached to a file. The agent also checks for possible timestomping (backdated timestamps) and searches leftover data for keyword hits.

• Parse MFT entries to find deleted file metadata
• Reconstruct file change activity from USN Journal records
• Extract and search slack space for residual data
• Detect and list Alternate Data Streams

Install the skill from ZIP or the Claude apps

Download the ZIP for this skill from this page and unzip it. For a personal install, place the unzipped skill folder in ~/.claude/skills/. To limit it to one project, place it in that project's .claude/skills/ folder.

If you use the Claude apps, you can upload the skill instead. Open Settings, go to Capabilities, then Skills, and upload it there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills

Trigger the skill with a natural request

You do not need a special command. Describe the task in plain language while you have an NTFS image available. The skill's description focuses on deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS, so requests that match that scope are the ones most likely to load it.

Be specific about the image path, the goal and the evidence you need. Mention that the image is a copy, not the original disk.

• "I have a copied NTFS image at /cases/case-2024-001/images/evidence.dd. Look for hidden data in alternate data streams."
• "Parse the MFT from this image and list deleted files with their timestamps."
• "Check the USN Change Journal for file deletions in the last part of the timeline."
• "Search the slack space of this volume for the words password and confidential."

What you need before you start

The skill expects a forensic disk image with an NTFS file system. It uses The Sleuth Kit tools (istat, icat, fls, blkls, blkstat, mmls, fsstat) and MFTECmd from Eric Zimmerman for Windows-based MFT and USN parsing. Python packages analyzeMFT and mft or pyusn are used for parsing, and foremost and bulk_extractor handle carving.

The workflow is for offline images. Do not point it at a live or production machine.

• Forensic disk image with an NTFS file system
• The Sleuth Kit command-line tools
• MFTECmd (Windows) for MFT and USN parsing
• Python with analyzeMFT and mft or pyusn
• foremost and bulk_extractor for carving

Safety notes on scripts and network use

This skill runs scripts. Its helper script is scripts/agent.py, and the workflow includes Python code and command-line tools. Read the scripts and commands before letting the agent run them, especially on evidence you cannot replace.

The skill does not use the network, according to its listing. Work on a copy of the image. The workflow is designed for offline images because running it against the original disk could alter evidence.

Only use it with legal authority and proper evidence-handling procedures, because it examines potentially private data.

• Work on a verified copy of the disk image, not the original
• Review scripts/agent.py and commands before running them
• Keep your chain-of-custody records up to date
• The skill does not use the network

Tips for better results

Give the agent the exact offset of the NTFS partition if you know it. The example commands use -o 2048, and mmls shows the partition layout. Ask for output saved to files, because the workflow writes results such as CSV and text files into case folders.

Ask for the reasoning behind a flag. Timestomping flags come from comparing timestamps, so treat them as leads to verify, not conclusions.

• Confirm the partition offset with mmls before parsing
• Ask the agent to save outputs to your case folder
• Verify every flagged item manually