Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-disk-forensicsgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-disk-forensics)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-disk-forensics"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-disk-forensics/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-disk-forensics"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-disk-forensics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.03848 |
| Opus 5 | $0.00025 | $0.01924 |
| Sonnet 5 | $0.00010 | $0.00770 |
| Haiku 4.5 | $0.00005 | $0.00385 |
Grade A, and why
re-disk-forensics scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 148 lines — stays where its author put it; the contents beside it link to each section on GitHub.
磁盘取证与文件系统分析
何时使用 / 何时不用
- 用：拿到磁盘镜像（dd / E01）或介质做取证——删除文件恢复、时间线重建、可疑文件/残留数据定位
- 用：事件响应需要"介质上发生过什么"（删了什么、什么时候写的、留了什么痕迹）
- 用：分区丢失/损坏后的分区表重建与文件抢救（testdisk）
- 不用：内存取证（那是 [[re-mem-forensics]]，与磁盘取证并列的另一个取证分支）
- 不用：普通文件系统挂载使用（那要可写挂载；取证一律只读，见坑 1）
- 不用：加密卷且无密钥——先找密钥（见坑 2）
工具准备
取证铁律：只读。本技能所有工具只读镜像文件、不挂载可写、不在原介质上写任何东西（见坑 1）。镜像获取与可疑对象提取的结果按 sha256 + 路径存档（取证要求可追溯，见 [[platform-tips]]）。
sleuthkit —— 取证分析主力（fls/icat/tsk_recover/mmls/fsstat/blkls）
- Debian/Ubuntu:
apt install sleuthkit - Fedora:
dnf install sleuthkit - Arch:
pacman -S sleuthkit（extra 仓库） - macOS:
brew install sleuthkit - Windows: WSL 内 Linux 版优先（见 [[platform-tips]] WSL 分支）；GUI 用 Autopsy（
winget install SleuthKit.Autopsy，内置 sleuthkit 工具） - 验证:
fls -h；mmls -h；tsk_recover -h；mactime -h
testdisk / photorec —— 分区修复与文件雕刻（cgsecurity）
- Debian/Ubuntu:
apt install testdisk（photorec 在同一包内，官方文档确认无独立包） - Fedora:
dnf install testdisk（photorec CLI 随包；GUI 版独立包qphotorec） - Arch:
pacman -S testdisk（extra，photorec 随包） - openSUSE:
zypper install testdisk photorec（该发行版 photorec 为独立包） - macOS:
brew install testdisk - Windows: WSL 内 Linux 版（chocolatey 上 testdisk 包极旧，不推荐）
- 验证:
testdisk /?；photorec /?
dd / ewf-tools —— 镜像获取
- dd: coreutils 自带（Linux/macOS/WSL 均可用）
- ewf-tools（E01 证据格式，带校验块）: Debian/Ubuntu
apt install ewf-tools/ Fedoradnf install ewf-tools/ Archpacman -S ewf-tools；验证:ewfacquire -V - Windows: 只读镜像工具 FTK Imager（GUI，exterro 官网免费版）或 WSL 内 Linux 版
只读挂载 —— loop + ro（需要直接读文件内容时）
- mount 内置（util-linux）；NTFS 需 ntfs-3g: Debian/Ubuntu
apt install ntfs-3g/ Fedoradnf install ntfs-3g/ Archpacman -S ntfs-3g - 验证:
mount -o ro,loop,noload ...后findmnt输出包含ro
autopsy —— 可选 GUI（团队/可视化）
- Debian/Ubuntu:
apt install autopsy；Fedora:dnf install autopsy；Arch:pacman -S autopsy（AUR 或 extra）；Windows:winget install SleuthKit.Autopsy；macOS:brew install --cask autopsy
操作步骤
按顺序执行，每步产物（镜像/提取文件/时间线）存档 sha256 + 路径（供 [[re-ioc]] 报告引用）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 148 lines · 50 tokens per session scan A 098ed3327ed6
re-disk-forensics is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 10d ago), licensed Apache-2.0. It adds 50 tokens to every session and 3,848 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
reverse-engineering-shellcode
Analyzes position-independent shellcode: disassembling raw bytes at the right architecture, recognizing PEB-walk API resolution and egg hunters, and emulating execution to recover behavior and payloads. Activates for requests to analyze shellcode, disassemble raw position-independent code, or emulate a shellcode blob.