> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Disk Image Forensics

> Investigate disk images with Sleuthkit, Plaso, and file carving via the sift-ssh MCP.

```
Investigate the disk image at /cases/disk.dd on SIFT:

1. Use sift-ssh hash_file to verify evidence integrity
2. Use sift-ssh triage_disk to get partition layout and filesystem info
3. Use sift-ssh disk_list_files to browse the file system
4. Use sift-ssh timeline_create to build a super-timeline
5. Use sift-ssh timeline_search to find activity around the incident timeframe
6. Use sift-ssh carve_files to recover deleted executables
7. Use sift-ssh extract_artifacts for bulk IOC extraction
8. Transfer any carved executables to REMnux for static analysis
9. Summarize: timeline of events, suspicious files, IOCs
```

> [!TIP]
>
> Carved executables land in `/cases/carved/`. Transfer them to REMnux via SCP and run `remnux-ssh triage_full` to continue the investigation.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.