[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71E2JA0KFGGH7KB1CTWJHDA":3,"skill-same:01M71E2JA0KFGGH7KB1CTWJHDA":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":35,"updatedAt":36,"install":37,"resources":50},"01M71E2JA0KFGGH7KB1CTWJHDA","linux-forensic-disk-filecarving-photorec-detect",null,"Linux Forensic Disk Filecarving Photorec Detect.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-forensic-disk-filecarving-photorec-detect\u002FSKILL.md",[],[19,20,21,22,23,24],"detect","photorec","linux forensic disk filecarving photorec detect","disk","linux","cybersecurity","2026-11-10 10:12:30",false,"---\nname: linux-forensic-disk-filecarving-photorec-detect\ndescription: \"Linux Forensic Disk Filecarving Photorec Detect.\"\ndomain: cybersecurity\n---\n\n|\n| PhotoRec | Open-source file carving tool supporting 300+ file formats |\n| TestDisk | Companion tool for partition recovery and repair |\n| Foremost | Alternative file carver originally developed by US Air Force OSI |\n| Scalpel | High-performance file carver based on Foremost |\n| hashdeep | Recursive hash computation and audit tool |\n| jpeginfo | JPEG file integrity verification |\n| file | Unix utility identifying file types by magic bytes |\n| exiftool | Extract metadata from recovered image and document files |\n\n## Common Scenarios\n\n**Scenario 1: Recovering Deleted Evidence from a Suspect's USB Drive**\nImage the USB drive with dcfldd, run PhotoRec targeting document and image formats, organize by file type, hash all recovered files, compare against known-bad hash sets, extract metadata from images for GPS and timestamp information.\n\n**Scenario 2: Formatted Hard Drive Recovery**\nRun PhotoRec in \"Whole\" mode against the entire formatted partition, recover all file types, expect higher false positive rate due to file fragmentation, validate recovered files with signature checking, catalog and hash for evidence chain.\n\n**Scenario 3: Memory Card from a Surveillance Camera**\nRecover deleted video files (AVI, MP4, MOV) from the memory card image, use targeted file type selection to speed recovery, verify video files are playable, extract frame timestamps, document recovery in case notes.\n\n**Scenario 4: Corrupted File System on Evidence Drive**\nWhen file system metadata is destroyed, PhotoRec bypasses the file system entirely and carves from raw sectors, recover maximum possible data, accept that file names and directory structure will be lost, rename files based on content during review.\n\n## Output Format\n\n```\nPhotoRec Recovery Summary:\n  Source Image:     evidence.dd (500 GB)\n  Partition:        NTFS (Partition 2)\n  Scan Mode:        Free space only\n\n  Files Recovered:  4,523\n    Documents:      234 (doc: 45, docx: 89, pdf: 67, xlsx: 33)\n    Images:         2,145 (jpg: 1,890, png: 198, gif: 57)\n    Videos:         34 (mp4: 22, avi: 12)\n    Archives:       67 (zip: 45, rar: 22)\n    Databases:      12 (sqlite: 8, dbf: 4)\n    Other:          2,031\n\n  Data Recovered:   12.4 GB\n  Corrupted Files:  312 (flagged for review)\n  Output Directory: \u002Fcases\u002Fcase-2024-001\u002Frecovered\u002Fall\u002F\n  Hash Manifest:    \u002Fcases\u002Fcase-2024-001\u002Frecovered\u002Frecovered_hashes.txt\n```\n","|\n| PhotoRec | Open-source file carving tool supporting 300+ file formats |\n| TestDisk | Companion tool for partition recovery and repair |\n| Foremost | Alternative file carver originally developed by US Air Force OSI |\n| Scalpel | High-performance file carver based on Foremost |\n| hashdeep | Recursive hash computation and audit tool |\n| jpeginfo | JPEG file integrity verification |\n| file | Unix utility identifying file types by magic bytes |\n| exiftool | Extract metadata from recovered image and document files |\n\n## Common Scenarios\n\n**Scenario 1: Recovering Deleted Evidence from a Suspect's USB Drive**\nImage the USB drive with dcfldd, run PhotoRec targeting document and image formats, organize by file type, hash all recovered files, compare against known-bad hash sets, extract metadata from images for GPS and timestamp information.\n\n**Scenario 2: Formatted Hard Drive Recovery**\nRun PhotoRec in \"Whole\" mode against the entire formatted partition, recover all file types, expect higher false positive rate due to file fragmentation, validate recovered files with signature checking, catalog and hash for evidence chain.\n\n**Scenario 3: Memory Card from a Surveillance Camera**\nRecover deleted video files (AVI, MP4, MOV) from the memory card image, use targeted file type selection to speed recovery, verify video files are playable, extract frame timestamps, document recovery in case notes.\n\n**Scenario 4: Corrupted File System on Evidence Drive**\nWhen file system metadata is destroyed, PhotoRec bypasses the file system entirely and carves from raw sectors, recover maximum possible data, accept that file names and directory structure will be lost, rename files based on content during review.\n\n## Output Format\n\n```\nPhotoRec Recovery Summary:\n  Source Image:     evidence.dd (500 GB)\n  Partition:        NTFS (Partition 2)\n  Scan Mode:        Free space only\n\n  Files Recovered:  4,523\n    Documents:      234 (doc: 45, docx: 89, pdf: 67, xlsx: 33)\n    Images:         2,145 (jpg: 1,890, png: 198, gif: 57)\n    Videos:         34 (mp4: 22, avi: 12)\n    Archives:       67 (zip: 45, rar: 22)\n    Databases:      12 (sqlite: 8, dbf: 4)\n    Other:          2,031\n\n  Data Recovered:   12.4 GB\n  Corrupted Files:  312 (flagged for review)\n  Output Directory: \u002Fcases\u002Fcase-2024-001\u002Frecovered\u002Fall\u002F\n  Hash Manifest:    \u002Fcases\u002Fcase-2024-001\u002Frecovered\u002Frecovered_hashes.txt\n```\n",{"name":5,"domain":24,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux-forensic-disk-filecarving-photorec-detect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill linux-forensic-disk-filecarving-photorec-detect",{"tool":43,"command":44},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill linux-forensic-disk-filecarving-photorec-detect",{"tool":46,"command":47},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill linux-forensic-disk-filecarving-photorec-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-forensic-disk-filecarving-photorec-detect\u002FSKILL.md",true,[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"index.json","REFERENCE","参考文档",588,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-forensic-disk-filecarving-photorec-detect\u002Findex.json",[58,82,105,127,149,165],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":25},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[65,19,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,24,81],"services","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":25},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,65,90,67,91,92,93,24,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":25},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[112,113,114,115,116,117,24,94,118,95,119,120,69,102,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":25},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[19,134,135,136,137,138,139,70,140,24,81,141,142,143,144,145,146,147,148,69],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":25},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,19,158,136,138,159,70,160,140,24,81,95,161,162,163,164,148,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":25},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,19,136,173,159,70,174,175,24,81,176,177,178,179,180,181,69,71,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]