DFIR Evidence Casebuilder

A defensible evidence index and normalized timeline whose conclusions can be independently reproduced. This standalone skill supplies an eight-phase operational playbook, evidence and authorization contract, JSON Schema, local validator, positive and negative fixtures, report template, and source/reuse notes. It defaults to read-only analysis and keeps facts, hypotheses, actions, and verification distinct.

Who it is for: DFIR practitioners, SOC teams, consultants, internal audit, and incident managers

Scope boundary: Defensive planning and authorized evidence analysis; no exploit payloads, credential theft, persistence, indiscriminate scanning, or silent external mutation.

Each skill ships with a local deterministic validator and positive/negative fixtures. Local fixture validation is not production safety, model lift, certification, or marketplace approval.