Public: Instructions file for Claude Code

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Overview

This is a comprehensive DFIR (Digital Forensics and Incident Response) tools repository containing production-ready forensic analysis scripts, containerized lab environments, and specialized plugins for memory analysis frameworks.

Environment Notes

• Host Environment: Windows with PowerShell (not Linux)
• WSL2 Access: Bash is available via WSL2 for Linux-specific commands
• CRITICAL: Avoid piping output to nul - this creates a file in Windows that breaks git push and other commands. Use >$null in PowerShell or >/dev/null in WSL2/bash instead.
• Container Development: Use Docker for Linux-specific testing and tools
• Cross-Platform Compatibility: Bash scripts are designed for Linux/macOS execution or WSL2
• Building: Request assistance for compilation if cross-platform issues occur

Code Best Practices

General Guidelines

• Always use descriptive variable names unless specifically asked to create obfuscated code
• If an instruction is unclear or impossible to complete without more information, ask questions
• Follow good practice designs for code and content unless directed otherwise

Bash Script Development

When writing or modifying bash scripts, follow these principles:

• Begin scripts with set -euo pipefail for strict error handling
• Include help output and comments explaining the "why" behind implementation choices
• Use full absolute paths for commands (e.g., /usr/bin/nmap instead of nmap)
• Always quote variables (e.g., "$variable") to prevent word splitting
• Validate and sanitize all user input to prevent command injection
• Use functions for complex tasks with local variables to prevent namespace pollution
• Include clear error messages that explain what went wrong and how to fix it
• Add logging for actions to support forensic analysis and auditing
• Run ShellCheck on critical scripts before deployment