---
name: dfir-toolkit
description: Use this skill when the user wants to cli tools for forensic investigation of windows artifacts.
---

# Dfir-toolkit Plugin

CLI tools for forensic investigation of Windows artifacts.

## Commands

### Operations
- `dfir-toolkit artifact analyze` — analyze artifact via dfir-toolkit
- `dfir-toolkit artifact extract` — extract artifact via dfir-toolkit
- `dfir-toolkit registry parse` — parse registry via dfir-toolkit
- `dfir-toolkit event-log parse` — parse event-log via dfir-toolkit
- `dfir-toolkit timeline generate` — generate timeline via dfir-toolkit
- `dfir-toolkit report generate` — generate report via dfir-toolkit
- `dfir-toolkit config show` — show config via dfir-toolkit

## Usage Examples
- "dfir-toolkit --help"
- "dfir-toolkit <args>"

## Installation

```bash
cargo install dfir-toolkit
```

## Examples

```bash
dfir-toolkit --version
dfir-toolkit --help
```

## Key Features
- forensics\n- windows\n- security
