Disk Image Scan
Read-only forensic inventory of raw disk images and large media blobs: hash a selected byte range, parse MBR/GPT partition maps, validate ext/NTFS/FAT/ISO filesystem candidates, and locate archive and evidence signatures with absolute byte and LBA offsets. Use before carving or filesystem recovery to map evidence-bearing regions. Pure Python; never mounts or modifies the image.
Install
$ agentstack add skill-batteryshark-rekit-disk-image-scan ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-batteryshark-rekit-disk-image-scan) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Disk Image Scanner
Inventory an image before recovery. Keep the source image read-only and write a machine-readable scan.jsonl plus summary.json beneath a new or empty output directory.
Workflow
- Record the source path, size, timestamps, selected range, and SHA-256.
- Parse MBR or GPT metadata when present; do not infer partitions from filenames.
- Stream the selected range and validate filesystem structures rather than trusting a
bare magic string.
- Use the emitted offsets to choose the next action:
- pass
scan.jsonltoforensic-archive-carve; - pass a validated filesystem
lba512orinferredStartLbato
filesystem-recover;
- use
binwalk-carvefor firmware filesystems and heterogeneous embedded payloads.
- Preserve
summary.jsonwith the recovery output. A full-image scan records
imageSha256; a partial scan records rangeSha256 and must not be represented as a whole-image hash.
Usage
bin/rekit run disk-image-scan evidence.img ./forensics/scan
bin/rekit run disk-image-scan evidence.img ./forensics/tail \
--start 11836177920 --length 28183404544Use --sector-size for GPT media whose logical sectors are not 512 bytes. Tune --chunk-mib for throughput. --max-hits bounds report growth; if the limit is reached, the summary marks the scan truncated. MBR inventory covers the four primary entries; filesystem scanning can still find candidates inside regions not described there, but extended-partition EBR chains are not parsed.
The runner opens the image only as rb. It never mounts the image, repairs metadata, or executes content.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: batteryshark
- Source: batteryshark/rekit
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.