Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLIAbout this skill
Reconstruct attack timelines through deep data recovery and log correlation, covering deleted-file recovery, memory-dump analysis, registry and shellbag forensics, and chain-of-custody documentation. Use this skill whenever the user mentions dfir, incident response, file recovery, memory dump, timeline reconstruction, registry analysis, shellbag, or is working with Volatility, Autopsy, Plaso, even if they never say \"digital forensics and incident response\" explicitly. Routes live lookups through the DFIR-API endpoint. Do not use it for unrelated application feature work or general coding questions.
Quick start
- Copy the install prompt. Use the green button above this README.
- Send it to your agent. Paste it into your coding agent’s chat and send.
- Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Review, license & listing details
This is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.
Only SKILL.md was scanned. Supporting files and scripts were not checked. No safety grade has been assigned.
0 potential findings · Scanned 11/4/2026 · Scanner 0.2.1
Content SHA-256: b4080b7b0d541106ade990ba6114dbfb65737b633d4c587bdef28a7521bbc086
About this listing
- Category
- Security
- Reported license
- Not specified
- Listing language (estimated)
- English
- Review status
- Not individually reviewed
- Agent compatibility
- Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.