Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.
安装
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-slack-space-and-file-system-artifactsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-slack-space-and-file-system-artifacts -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-slack-space-and-file-system-artifacts -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-slack-space-and-file-system-artifactsgh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-slack-space-and-file-system-artifactsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-slack-space-and-file-system-artifacts ~/.claude/skills/analyzing-slack-space-and-file-system-artifacts # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-slack-space-and-file-system-artifacts ~/.agents/skills/analyzing-slack-space-and-file-system-artifacts # Codex, Cursor, Gemini CLI, Copilot, OpenCode