Skip to content
Get packs

Autopsy Disk Image Analysis

Guides an agent through forensic analysis of disk images with Autopsy and The Sleuth Kit.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent can walk you through a structured digital forensics workflow on a disk image (raw dd, E01 or AFF files): checking partitions, listing and recovering deleted files, searching for keywords and file signatures, and building timelines and HTML reports in Autopsy. It also includes a small Python helper that runs Sleuth Kit command-line tools on an image and parses their output.

Great for

  • Digital forensics students learning the Autopsy and Sleuth Kit workflow
  • Examiners who want a checklist-style guide for analyzing a disk image
  • Security teams preparing structured reports from evidence they are already authorized to examine

Skip it if

  • Analysing disk images you do not have legal authority to examine, since recovering deleted files and personal data raises privacy and legal issues
  • Production evidence handling without an accredited chain-of-custody process, because the guide does not cover this and the agent's output is not a substitute for expert review
  • Users expecting a one-click tool; the workflow assumes Autopsy, Sleuth Kit and large hash sets are installed and configured

Try asking

  • “Walk me through verifying a dd image and listing its partitions with Sleuth Kit before I open it in Autopsy.”
  • “Help me recover deleted files from partition 2 of evidence.dd and extract a Word document by inode.”
  • “Set up keyword searches for credit card and SSN patterns and tag the hits for review.”
  • “Build a timeline of file activity for the incident window and generate an HTML report.”
Step-by-step guide: how to use Autopsy Disk Image AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-disk-image-with-autopsy.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-disk-image-with-autopsy.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-disk-image-with-autopsy.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Verify the image hash and keep original evidence read-only; work on copies so the source is never altered.
  • Check the bundled script's commands and paths before running it, since it executes Sleuth Kit tools via subprocess on the file paths you give it.
  • Confirm your jurisdiction's authorization and documentation requirements before running recovery or keyword searches on any image.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.