Skip to content
Get packs

MFT Deleted File Recovery

Recovers traces of deleted files and detects timestomping from NTFS Master File Table artifacts.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill teaches an AI agent how to examine the NTFS metadata on a Windows disk image to find evidence of files that were deleted. It guides the agent through parsing the Master File Table, the USN Journal, the $LogFile, and MFT slack space, and through correlating these with Recycle Bin artifacts. It also includes Python helper scripts that read MFTECmd CSV output to flag deleted entries and possible timestomping, which is a sign of anti-forensic tampering.

Great for

  • Digital forensics and incident response analysts working on Windows disk images
  • Security students learning NTFS file system internals and recovery techniques

Skip it if

  • Live production systems or anyone without authorization to examine the disk image, since this is evidence-handling work that can raise legal and privacy issues
  • Non-forensic file recovery from a healthy drive, where ordinary recovery tools are simpler and safer

Try asking

  • “Analyze this $MFT CSV export and list all deleted files with their original parent paths”
  • “Check these MFT timestamps for signs of timestomping and explain the discrepancies”
  • “Build a timeline of file deletions from the USN Journal and $LogFile on this image”
  • “Correlate Recycle Bin $I and $R files with MFT entry numbers”
Step-by-step guide: how to use MFT Deleted File RecoveryInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    analyzing-mft-for-deleted-file-recovery.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-mft-for-deleted-file-recovery.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-mft-for-deleted-file-recovery.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on a verified copy of the disk image, never the original evidence, and document hashes before analysis.
  • Export MFTECmd CSV first and point the Python scripts at that file; the scripts read local files and make no network calls in the excerpts shown.
  • Treat timestomping findings as indicators to verify with USN Journal and $LogFile evidence, not as proof on their own.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.