Skip to content
Get packs

NTFS Slack Space Forensics

Lets the agent dig through NTFS disk artifacts (MFT, USN journal, slack space, ADS) for forensic investigations.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent how to perform deep forensic examination of a Windows NTFS disk image. Instead of only recovering ordinary files, the agent walks through the file system's internal records: the Master File Table (which lists files and their metadata, including deleted ones), the USN Change Journal (a log of file changes), leftover unused space at the end of files (slack space), and Alternate Data Streams (hidden extra data attached to files). It then guides the agent to flag possible timestomping (backdated timestamps) and keyword hits in leftover data. The agent gets step-by-step commands using The Sleuth Kit and related tools, plus a Python helper script that can run analyzeMFT, extract slack space, and search it for sensitive keywords.

Great for

  • Digital forensics analysts examining a copied NTFS disk image
  • Incident responders who need to find hidden or residual data beyond normal file recovery
  • Students learning how NTFS artifacts such as MFT and USN records work

Skip it if

  • Live systems or production machines, since the workflow is designed for offline forensic images and could alter evidence if run on the original disk
  • Investigations without legal authority or proper evidence-handling procedures, because it examines potentially private data
  • Routine file recovery, which standard tools handle more simply

Try asking

  • “Analyze this NTFS evidence image for deleted files and possible timestomping in the MFT”
  • “Search the slack space of this disk image for hidden keywords like passwords or credit card numbers”
  • “Parse the USN Change Journal from this image and reconstruct file activity over the past week”
  • “Check the evidence for Alternate Data Streams that might hide malware”
Step-by-step guide: how to use NTFS Slack Space ForensicsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-slack-space-and-file-system-artifacts.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-slack-space-and-file-system-artifacts.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-slack-space-and-file-system-artifacts.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always work on a verified copy of the image and keep hashes of the original so findings remain defensible.
  • Treat keyword and timestomping hits as leads to verify manually, since slack-space matches and timestamp deltas can be false positives.
  • Check the script's paths and offsets (such as partition offset 2048) against your own mmls output before running it.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.