Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add killvxk/cybersecurity-skills-zh/plugin install cybersecurity-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-disk-image-with-autopsy)<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-disk-image-with-autopsy"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-disk-image-with-autopsy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-disk-image-with-autopsy"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-disk-image-with-autopsy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.03161 |
| Opus 5 | $0.00019 | $0.01580 |
| Sonnet 5 | $0.00008 | $0.00632 |
| Haiku 4.5 | $0.00004 | $0.00316 |
Grade B, and why
analyzing-disk-image-with-autopsy scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo apt-get install autopsy sleuthkit Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
wget https://github.com/sleuthkit/autopsy/releases/download/autopsy-4.21.0/autopsy-4.21.0.zip How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
使用 Autopsy 分析磁盘镜像
适用场景
- 当您有取证磁盘镜像并需要对其内容进行结构化分析时
- 调查需要文件恢复、关键词搜索和时间线分析时
- 当非技术利益相关方需要从取证证据中获取可视化报告时
- 检查文件系统元数据、已删除文件和嵌入的痕迹时
- 从多个磁盘镜像构建全面案件时
前置条件
- 已安装 Autopsy 4.x（Windows）或带 The Sleuth Kit 的 Autopsy 4.x（Linux）
- raw（dd）、E01（EnCase）或 AFF 格式的取证磁盘镜像
- 最低 8GB RAM（大型镜像建议 16GB）
- Autopsy 所需的 Java 运行时环境（JRE）8+
- 足够的磁盘空间用于 Autopsy 案件数据库（镜像大小的 2-3 倍）
- 用于文件识别的哈希数据库（NSRL、已知恶意哈希）
工作流程
步骤 1：安装 Autopsy 并配置环境
# 在 Linux 上安装 Sleuth Kit 和 Autopsy
sudo apt-get install autopsy sleuthkit
# 从官方来源下载 Autopsy 4.x（GUI 版本）
wget https://github.com/sleuthkit/autopsy/releases/download/autopsy-4.21.0/autopsy-4.21.0.zip
unzip autopsy-4.21.0.zip -d /opt/autopsy
# 在 Windows 上，从 sleuthkit.org 运行 MSI 安装程序
# 启动 Autopsy
/opt/autopsy/bin/autopsy --nosplash
# 同时安装 Sleuth Kit 命令行工具配合 Autopsy 使用
sudo apt-get install sleuthkit
步骤 2：创建新案件并添加磁盘镜像
1. 启动 Autopsy > "New Case"（新建案件）
2. 输入案件名称: "CASE-2024-001-Workstation"
3. 设置基本目录: /cases/case-2024-001/autopsy/
4. 输入案件编号、检验员姓名
5. 点击 "Add Data Source"（添加数据源）
6. 选择 "Disk Image or VM File"（磁盘镜像或虚拟机文件）
7. 浏览至: /cases/case-2024-001/images/evidence.dd
8. 选择原始系统的时区
9. 配置摄取模块（见步骤 3）
# 也可以先用 Sleuth Kit CLI 验证镜像
img_stat /cases/case-2024-001/images/evidence.dd
# 列出镜像中的分区
mmls /cases/case-2024-001/images/evidence.dd
# 输出示例:
# DOS Partition Table
# Offset Sector: 0
# Units are in 512-byte sectors
# Slot Start End Length Description
# 00: ----- 0000000000 0000002047 0000002048 Primary Table (#0)
# 01: 00:00 0000002048 0001026047 0001024000 NTFS (0x07)
# 02: 00:01 0001026048 0976771071 0975745024 NTFS (0x07)
# 列出分区中的文件（偏移量 2048 扇区）
fls -o 2048 /cases/case-2024-001/images/evidence.dd
步骤 3：配置并运行摄取模块
启用以下 Autopsy 摄取模块:
- Recent Activity（最近活动）: 提取浏览器历史、下载记录、Cookie、书签
- Hash Lookup（哈希查找）: 对照 NSRL 和已知恶意哈希集比对文件
- File Type Identification（文件类型识别）: 通过特征而非扩展名识别文件
- Keyword Search（关键词搜索）: 对内容建立全文搜索索引
- Email Parser（邮件解析器）: 从 PST、MBOX、EML 文件中提取邮件
- Extension Mismatch Detector（扩展名不匹配检测器）: 查找扩展名错误的文件
- Exif Parser（Exif 解析器）: 从图像中提取元数据（GPS、相机、时间戳）
- Encryption Detection（加密检测）: 识别加密文件和容器
- Interesting Files Identifier（有趣文件识别器）: 标记匹配自定义规则集的文件
- Embedded File Extractor（嵌入文件提取器）: 从 ZIP、Office 文档、PDF 中提取文件
- Picture Analyzer（图片分析器）: 使用 PhotoDNA 或哈希匹配分类图像
- Data Source Integrity（数据源完整性）: 在摄取期间验证镜像哈希
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 250 lines · 38 tokens per session scan B 5a9d7fb9574d
analyzing-disk-image-with-autopsy is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (44 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 38 tokens to every session and 3,161 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-disk-image-with-autopsy
Use when perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines. Use when performing comprehensive forensic analysis of disk images using autopsy to.
analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
analyzing-windows-registry-for-artifacts
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
analyzing-windows-registry-for-artifacts
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
recovering-deleted-files-with-photorec
Recover deleted files from disk images and storage media using PhotoRec's file signature-based carving engine regardless of file system damage.
analyzing-windows-registry-for-artifacts
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.