{
  "schema": "skillstore.package/v1",
  "id": "sleuthkit",
  "name": "Sleuth Kit Filesystem Forensics",
  "description": "Disk-image and filesystem forensic workflow using EWF utilities, The Sleuth Kit, mactime and carving tools.",
  "entry": "SKILL.md",
  "source": {
    "repository": "https://github.com/teamdfir/protocol-sift/tree/main/skills/sleuthkit",
    "author": "Rob Lee / teamdfir"
  },
  "tags": ["dfir", "sleuthkit", "filesystem", "ewf", "file-recovery", "sift"],
  "compatibility": ["SANS SIFT Workstation", "filesystem-capable AI agent"]
}