analyzing-mft-for-deleted-file-recovery
by mukul975analyzing-mft-for-deleted-file-recovery helps recover deleted-file metadata and possible path or content evidence by analyzing NTFS $MFT records, $LogFile, $UsnJrnl, and MFT slack space. Built for DFIR and Security Audit workflows with MFTECmd, analyzeMFT, and X-Ways Forensics.
This skill scores 78/100, which means it is a solid directory listing candidate for users doing NTFS forensic recovery work. The repository gives enough concrete workflow, reference material, and supporting scripts to help an agent trigger and execute the task with less guesswork than a generic prompt, though it still leaves some adoption friction because the install path is not explicit.
- Strong domain specificity: the frontmatter clearly targets NTFS MFT analysis for deleted-file recovery with relevant tags and NIST CSF mappings.
- Operational support is present: two scripts plus workflow and reference docs cover parsing MFT output, deleted-record filtering, timeline reconstruction, and slack-space recovery.
- Good install decision value: the repo includes standards, technical references, and a report template, helping users judge fit for DFIR workflows.
- No install command or explicit setup instructions in SKILL.md, so agents may need extra guesswork to wire up execution.
- Some evidence points to utility around external tools like MFTECmd and analyzeMFT, which means the skill depends on a broader forensic toolchain rather than being fully self-contained.
Overview of analyzing-mft-for-deleted-file-recovery skill
What this skill does
The analyzing-mft-for-deleted-file-recovery skill helps you analyze the NTFS Master File Table ($MFT) to recover deleted-file metadata and, where possible, evidence of content or path history. It is built for DFIR work where the goal is not just “find deleted files,” but reconstruct what existed, when it changed, and whether timestamps or metadata were manipulated.
Who should install it
Install the analyzing-mft-for-deleted-file-recovery skill if you do incident response, forensic triage, or Security Audit work on NTFS volumes and want a structured workflow for deleted-file recovery. It is a strong fit when you already have an image, a raw $MFT, or MFTECmd output and need repeatable analysis rather than a generic prompt.
Why it is useful
The main value is practical workflow support: it centers on deleted records, timestamps, $UsnJrnl, $LogFile, and MFT slack space. That combination gives better information gain than a simple “parse MFT” prompt because it encourages cross-correlation, not just record listing.
How to Use analyzing-mft-for-deleted-file-recovery skill
Install and inspect the right files
Use the install path shown in the repo instructions: npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-mft-for-deleted-file-recovery. After install, read SKILL.md first, then references/workflows.md, references/api-reference.md, and references/standards.md. If you are validating output quality or report shape, open assets/template.md early so your prompts match the expected deliverable.
Give the skill case-ready input
The analyzing-mft-for-deleted-file-recovery usage works best when you provide three things up front: the evidence source, the question, and the constraint. For example: “Analyze this MFTECmd CSV from C:\Users\...\NTFS to identify deleted files, likely deletion time, and timestomping indicators; return a concise Security Audit summary.” That is stronger than “help me recover deleted files,” because it tells the skill what output to prioritize.
Follow the repository workflow order
A practical analyzing-mft-for-deleted-file-recovery guide is: extract or supply $MFT, parse with MFTECmd or analyzeMFT, filter for deleted records (InUse = False), compare $SI and $FN timestamps, then cross-reference $UsnJrnl and $LogFile for sequence and deletion context. If you suspect partial recovery, inspect MFT slack space after the main parse so you do not miss residual attribute data.
Improve prompt quality with output constraints
When asking for analysis, specify the format you need: table, timeline, triage notes, or audit-ready summary. Include whether you want only deleted records, only timestomping candidates, or a full merged timeline. For analyzing-mft-for-deleted-file-recovery for Security Audit, ask for explicit findings, confidence notes, and any evidence gaps so the result is usable in a review packet.
analyzing-mft-for-deleted-file-recovery skill FAQ
Is this only for deleted-file recovery?
No. The skill is centered on deleted-file recovery, but it also supports timeline reconstruction and anti-forensics review. If your actual task is broad NTFS triage with no deleted-file question, a general filesystem forensics prompt may be enough.
Do I need MFTECmd to use it well?
MFTECmd is the most natural input path, but not the only one. The skill also aligns with analyzeMFT and raw MFT review. If you only have a disk image and no parsed output, you will get better results after extracting $MFT or generating CSV first.
Is it suitable for beginners?
Yes, if the user can provide evidence and a clear question. The skill is more useful than a blank prompt for beginners because it points them toward the right artifacts and checks. It is less suitable if the user cannot distinguish an NTFS volume from a generic file listing.
When should I not use it?
Do not use analyzing-mft-for-deleted-file-recovery if the filesystem is not NTFS, if the case has no deletion or timestamp issue, or if you need full content carving rather than metadata-led recovery. In those cases, a different forensic workflow will be faster.
How to Improve analyzing-mft-for-deleted-file-recovery skill
Feed it stronger evidence, not just a goal
Better inputs name the source and scope: “MFTECmd CSV from one workstation, focus on deleted documents in Downloads, include parent path and deletion indicators.” That is better than “analyze the MFT,” because the skill can then prioritize relevant rows instead of summarizing everything.
Ask for the right forensic comparisons
The main quality driver is comparison between $SI, $FN, $UsnJrnl, and $LogFile. If you care about analyzing-mft-for-deleted-file-recovery skill output quality, ask the model to explain mismatches, not just list timestamps. This helps catch timestomping, rename history, and cases where the deleted record still has usable path metadata.
Watch for common failure modes
The most common failure is overclaiming recovery certainty from incomplete metadata. A deleted MFT record may preserve filenames and timestamps without preserving file content. Another failure is missing reallocation risk: if the record has been reused, recovered details may be partial or misleading. Tell the skill to separate confirmed facts from inferred ones.
Iterate with a tighter second pass
After the first output, refine with a narrower prompt: “Re-run the analysis on only deleted records with mismatched $SI and $FN created times; return a short findings table and a one-paragraph Security Audit conclusion.” This improves signal by forcing the skill to rank evidence, not restate it.