Skip to content

CLAUDE.md

Latest commit

 

History

History
19 lines (12 loc) · 705 Bytes

CLAUDE.md

File metadata and controls

19 lines (12 loc) · 705 Bytes
Raw

Agent Forensics Skills

A collection of LLM skills for DFIR (Digital Forensics and Incident Response) tooling.

Tool Resolution

Before running a forensic tool, check PATH first, then tools\<ToolName>\ relative to this repo. If the tool isn't found, ask the user for its location. Never hard-code absolute paths.

Case Directory

Users should define a case directory before running any tools. If no case directory has been established, ask the user to specify one. All tool output should be written to this directory.

Example structure:

C:\Cases\<CaseName>\
  Evidence\        # source artifacts (evtx, $MFT, images, etc.)
  Output\          # tool output (CSV, JSON, timelines, etc.)