Disk Forensics

Comprehensive disk forensics skill for analyzing storage media, file systems, and persistent artifacts. Enables recovery of deleted files, analysis of file system metadata, detection of hidden data, and extraction of forensic artifacts from disk images.

Capabilities

• Disk Image Acquisition: Create forensically sound disk images with integrity verification
• File System Analysis: Parse and analyze NTFS, FAT, EXT, HFS+, APFS file systems
• Deleted File Recovery: Recover deleted files using file carving and file system analysis
• MFT Analysis: Parse NTFS Master File Table for file metadata and timestamps
• Slack Space Analysis: Examine slack space for hidden or residual data
• Alternate Data Streams: Detect and extract NTFS alternate data streams
• File Signature Analysis: Verify file signatures and detect mismatched extensions
• Hash Analysis: Calculate and verify file hashes for integrity and known file detection
• Volume Shadow Copy Analysis: Extract and analyze Windows Volume Shadow Copies
• Partition Analysis: Detect hidden partitions, analyze partition tables

Quick Start