analyzing-mft-for-deleted-file-recovery

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering evidence of deleted files, reconstructing NTFS file-system timelines, or detecting anti-forensic timestomping during a Windows forensic examination.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-mft-for-deleted-file-recovery/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is actionable with real tool commands and a working script, but it is padded with foundational NTFS explanation, lacks a sequenced workflow with validation checkpoints, and fails to reference its own bundle files. Tightening the overview and surfacing the bundle would lift several dimensions.

Suggestions

Replace the Overview's general NTFS/MFT primer and the inlined record-header/attribute tables with a pointer to references/api-reference.md, keeping only what is non-obvious for this skill.

Turn the four Techniques into an ordered workflow with explicit validation checkpoints (e.g., verify image integrity, confirm record parse counts, cross-check USN vs $LogFile findings before reporting).

Link to the bundle from the body — cite references/workflows.md for the step-by-step flows, scripts/process.py and scripts/agent.py for automation, and assets/template.md for output structure — so the references are one level deep and clearly signaled.

Dimension	Reasoning	Score
Conciseness	The Overview and inlined MFT record-header/attribute tables explain NTFS basics and reference material that Claude largely already knows, and the 'When to Use' bullets are padded; useful domain specifics offset but do not remove the over-explanation.	3 / 5
Actionability	Provides concrete, mostly executable commands (MFTECmd.exe with real flags, RBCmd, vssadmin) and a working Python slack-space parser, with only minor gaps such as the LogFileParser invocation details.	4 / 5
Workflow Clarity	Techniques are presented as parallel options rather than a sequenced process, and destructive/batch forensic operations (extraction, carving, cross-volume comparison) lack explicit validation/verification checkpoints; per the rubric cap this cannot exceed 3.	3 / 5
Progressive Disclosure	A bundle exists (references/, scripts/, assets/) but the body never links to it; the MFT header and attribute tables are inlined and duplicated in api-reference.md, and the References section points only to external URLs, so navigation to the bundled material is unclear.	3 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names tools and artifacts, answers both what and when with concrete triggers, and occupies a distinct niche. Minor improvement possible by adding a couple of common synonyms or file-extension cues.

Dimension	Reasoning	Score
Specificity	Names specific tools (MFTECmd, analyzeMFT, X-Ways Forensics) and concrete artifacts ($MFT, $LogFile, $UsnJrnl, MFT slack space) with multiple specific actions (recover metadata and content, examine record entries), giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both 'what' (analyze $MFT with named tools to recover metadata and content of deleted files) and 'when' with concrete trigger phrases ('Use when recovering evidence... reconstructing timelines... detecting timestomping').	5 / 5
Trigger Term Quality	Strong natural trigger phrases ('Use when recovering evidence of deleted files, reconstructing NTFS file-system timelines, or detecting anti-forensic timestomping') with good synonym coverage, though a few common user-facing variations or file extensions are absent.	4 / 5
Distinctiveness Conflict Risk	A clear niche (NTFS MFT deleted-file recovery) with distinct, specialized triggers that are unlikely to fire for unrelated skills, giving minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-mft-for-deleted-file-recovery/SKILL.md
Commit: 54a7988

Reviewed: 6 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.