# How to Initialize a New Analysis Case with case-init.ps1 in Reverse-Skill

> Initialize a new analysis case with case-init.ps1. Generate a structured work directory with scope.md, timeline.md, workitems.md, and evidence folders for efficient reverse engineering.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-06

---

**Run `case-init.ps1` with a `-Hint` and optional `-TargetUrl` to generate a structured case directory under `work/` containing [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md), [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md), and `evidence/` subfolders.**

The `case-init.ps1` script in the zhaoxuya520/reverse-skill repository serves as the entry point for creating standardized analysis cases. It automates the directory structure, documentation templates, and network authorization tracking required for reverse engineering and penetration testing workflows.

## Core Initialization Workflow

When executed, `skills/scripts/case-init.ps1` performs a nine-step pipeline to scaffold a compliant analysis environment. The script resolves project paths, validates inputs, and populates markdown templates according to the operational contracts defined in `skills/ops/`.

### Step 1: Resolve the Project Root

The script locates the reverse-skill repository root by calling `Resolve-ReverseProjectRoot` from `skills/scripts/lib/WorkRoot.ps1`. This helper function ensures all subsequent file operations occur within the correct project context, regardless of the current working directory.

### Step 2: Generate the Case Name

If you omit the `-CaseName` parameter, the script constructs a slug from the `-Hint` argument and appends a timestamp. For example, passing `-Hint "web pentest"` generates a directory name like `20231127-143200-web-pentest`.

### Step 3: Validate Directory Constraints

The script enforces a 1‑80 character limit on the case name and verifies it contains no illegal Windows path characters. Invalid inputs trigger an immediate termination before any files are written.

### Step 4: Create the Directory Structure

Under `work/<CaseName>/`, the script creates three subfolders:

- `evidence/` – Stores raw artifacts and captured data
- `notes/` – Contains analyst observations and scratchpad files
- `report/` – Holds final deliverables and exported documentation

### Step 5: Resolve Authentication and Network Profile

The script processes authorization flags to establish the operational boundary:

- `-AuthGranted` or `-AuthStatus` set the authorization state (default is `pending`)
- `-TargetUrl` and `-InScopeAssets` build the asset inventory
- The `network_profile` is selected from options including `offline`, `lab_only`, or `authorized_target_only` based on the provided assets and auth status

### Step 6: Determine Ready-for-Act Status

A case is marked "ready for act" only when three conditions are met simultaneously: authorization status is **granted**, at least one asset is present in scope, and the network profile is not set to `offline`.

### Step 7: Route to Primary Skill (Optional)

If `skills/scripts/master-route.ps1` exists and a `-Hint` is supplied, the script extracts the primary skill path (e.g., [`reverse-engineering/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/reverse-engineering/SKILL.md)) and associates it with the case metadata.

### Step 8: Populate Markdown Templates

The script generates four standardized files containing metadata and checklists:

- [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) – Defines boundaries and authorization status per [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md)
- [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) – Tracks chronological milestones per [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md)
- [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) – Contains initial task tables and completion checkboxes
- [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) – Provides case summary and quick-reference links

### Step 9: Print Execution Summary

Finally, the script echoes the case path, project root, primary skill (if identified), and ready-state to the console for immediate verification.

## Practical Usage Examples

Create a basic web application pentest case with explicit authorization:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -Hint "web pentest" `
    -TargetUrl "https://app.example/" `
    -AuthGranted

```

Specify a custom case name and restrictive network profile for an internal assessment:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -CaseName "my-pentest-case" `
    -Hint "internal app assessment" `
    -TargetUrl "https://10.0.0.5/" `
    -NetworkProfile "authorized_target_only" `
    -AuthGranted

```

Initialize a malware analysis case with default pending authorization and multiple assets:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -Hint "malware analysis" `
    -InScopeAssets "malware.bin","C:\Samples\payload.exe"

```

## Key Source Files and Dependencies

Understanding the following modules helps troubleshoot initialization failures:

- **`skills/scripts/case-init.ps1`** – Core orchestration logic that creates directories and writes templates
- **`skills/scripts/lib/WorkRoot.ps1`** – Provides `Resolve-ReverseProjectRoot` for repository discovery
- **`skills/scripts/master-route.ps1`** – Optional routing module that maps hints to skill definitions
- **[`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md)** – Schema reference for generated [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) files
- **[`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md)** – Contract defining [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) and [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) structure

## Summary

- `case-init.ps1` requires either `-CaseName` or `-Hint` to generate the `work/<CaseName>/` directory structure
- The script creates standardized `evidence/`, `notes/`, and `report/` subdirectories automatically
- Authorization status and network profiles determine whether a case is marked ready for active engagement
- Markdown templates follow the operational contracts stored in `skills/ops/` to ensure consistency across reverse-skill projects

## Frequently Asked Questions

### What happens if I don't specify a `-CaseName`?

The script automatically generates a case name by combining your `-Hint` value with a timestamp in the format `YYYYMMDD-HHMMSS-<hint>`. This ensures unique directory names while preserving descriptive context.

### How does the script determine if a case is ready for action?

According to the source logic in `case-init.ps1`, a case achieves ready-for-act status only when three conditions align: the `-AuthGranted` flag is present (or `-AuthStatus` is set to granted), at least one target asset is defined via `-TargetUrl` or `-InScopeAssets`, and the resolved `network_profile` is not `offline`.

### Where are the generated case files stored?

All cases are created under the `work/` directory at the repository root, as resolved by `Resolve-ReverseProjectRoot`. Each case receives its own subdirectory containing [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md), [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md), [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md), and the three standard subfolders: `evidence/`, `notes/`, and `report/`.

### Can I initialize a case without network authorization?

Yes. Omitting `-AuthGranted` defaults the authorization status to `pending`. However, the case will not be marked as "ready for act" until you later update the status to granted and ensure the network profile supports active engagement.