evidence-preservation

What problem does it solve?

This Skill ensures that digital evidence is collected, documented, and preserved in a forensically sound manner, maintaining its integrity and admissibility in legal proceedings.

Core Features & Use Cases

• Chain of Custody: Generates detailed logs tracking the handling and transfer of evidence.
• Evidence Hashing: Creates cryptographic hashes (e.g., SHA256) to verify data integrity.
• Volatile Data Collection: Guides the collection of time-sensitive data in the correct order.
• Use Case: A security incident occurs, and you need to collect logs, running processes, and disk images from affected systems while ensuring every step is documented for potential legal review.

Quick Start

Begin the evidence preservation process by running the preserve evidence command.