# How to Create a New Case Directory with case-init.ps1

> Learn how to create a new case directory using case-init.ps1. Generate structured directories with essential files like scope.md and timeline.md for your reverse-skill projects.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-02

---

**Run `skills/scripts/case-init.ps1` with a `-Hint` or `-CaseName` parameter to generate a structured `work/<case>/` directory containing [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md), [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md), and sub-folders for evidence, notes, and reports.**

The `reverse-skill` framework standardizes digital investigations through rigorous case management. At the heart of this workflow sits `case-init.ps1`, the entry-point script that automates bootstrap procedures defined in the repository’s operational contracts. When you **create a new case directory with case-init.ps1**, the script enforces validation rules, resolves network and authorization contexts, and emits UTF-8 encoded markdown artefacts that serve as the single source of truth for the engagement.

## What the Script Generates

Executing `case-init.ps1` produces a self-contained workspace under `work/<CaseName>/` with the following structure:

- **Core artefacts**: [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md), [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md), and [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md)
- **Evidence handling**: `evidence/` sub-directory for raw forensic data
- **Working papers**: `notes/` directory for analyst observations
- **Deliverables**: `report/` directory for final outputs

According to the source code in `zhaoxuya520/reverse-skill`, the script writes all files using UTF-8 encoding to prevent character corruption across platforms.

## Execution Flow and Source Code Logic

The script operates through nine discrete phases, each mapped to specific line ranges in `skills/scripts/case-init.ps1`.

### Parameter Handling and Case Name Generation (Lines 27-33)

If you omit `-CaseName`, the script derives a slug from the `-Hint` parameter (or defaults to "case") and appends a timestamp to guarantee uniqueness. This prevents accidental overwrites of existing investigations.

### Directory Name Validation (Lines 38-42)

Before any disk write occurs, the script validates the proposed name against a strict regex pattern. The check disallows path separators, trailing dots or spaces, control characters, and wildcards, ensuring the resulting path is safe for filesystem operations.

### Physical Directory Creation (Lines 44-49)

Once validated, the script creates `work/<CaseName>/` and immediately populates it with three sub-folders: `evidence`, `notes`, and `report`. This hierarchy aligns with the [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) specification.

### Scope and Network Resolution (Lines 51-94)

The script normalizes contextual flags into an internal scope model:

- `-AuthGranted` and `-AuthStatus` map to `auth.status`
- `-TargetUrl` and `-InScopeAssets` populate `in_scope.assets`
- `-NetworkProfile` sets `network_profile.mode` (e.g., `offline`, `lab_only`, or `full`)

### Master-Route Skill Discovery (Lines 21-38)

If you supply a `-Hint` and the file `master-route.ps1` exists, the script executes it to determine the primary skill identifier. This allows dynamic routing; for example, the hint "reverse-engineer firmware" might resolve to [`skills/firmware-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-reverse/SKILL.md), which is then recorded in the generated [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md).

### Artefact Composition and Writing (Lines 58-154)

The script builds three markdown documents:

1. **Scope** (lines 62-108): Combines auth status, network profile, and asset lists into a contract-compliant document
2. **Timeline** (lines 124-135): Initializes a chronological event log
3. **Work-items** (lines 138-154): Generates a scaffold table for tracking tasks

All content is written to disk between lines 58-62 using deterministic UTF-8 encoding.

### User Feedback (Lines 90-97)

Finally, the script emits a summary to the console, listing the absolute path of the new case, the detected primary skill, current auth status, and network profile, along with next-step guidance.

## Required Parameters and Validation Rules

You must provide at least one of the following:

- `-CaseName <String>`: Explicit directory name (subject to validation)
- `-Hint <String>`: Descriptive text used to auto-generate the directory name and optionally trigger `master-route.ps1`

The validation regex at lines 38-42 rejects any input containing:
- Path separators (`\` or `/`)
- Trailing dots or spaces
- Control characters (0x00-0x1F)
- Wildcards (`*` or `?`)

## Practical Examples

### Minimal Case Creation

Create a case using only a hint, letting the script generate the timestamped directory name:

```powershell
powershell -File skills/scripts/case-init.ps1 -Hint "web pentest"

```

*Result*: A directory named `work/20231128-152300-web-pentest/` with `auth.status` set to pending and `network_profile.mode` set to offline.

### Full-Featured Invocation with Auth and Target

Bootstrap a pre-authorized investigation with explicit network constraints:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -Hint "mobile malware analysis" `
    -CaseName my-mobile-case `
    -AuthGranted `
    -TargetUrl "https://app.example.com/" `
    -NetworkProfile lab_only

```

*Result*: The [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file contains `ready_for_act = true`, `in_scope.assets` lists the target URL, and `network_profile.mode` reflects `lab_only`.

### Integration with Master-Route Discovery

Trigger automatic skill detection based on the hint:

```powershell
powershell -File skills/scripts/case-init.ps1 -Hint "reverse-engineer firmware"

```

*Result*: If `master-route.ps1` maps the hint to [`skills/firmware-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-reverse/SKILL.md), the case [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) points directly to that skill as the recommended next action.

## Summary

- **Entry point**: `skills/scripts/case-init.ps1` is the sole supported method to create a new case directory with case-init.ps1 in the reverse-skill framework.
- **Validation**: Directory names must pass a strict regex (lines 38-42) to prevent filesystem traversal or illegal character injection.
- **Artefacts**: Every case receives [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md), [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md), and three sub-folders (`evidence`, `notes`, `report`).
- **Context**: Flags like `-AuthGranted`, `-TargetUrl`, and `-NetworkProfile` are normalized into the scope contract during lines 51-94.
- **Extensibility**: The optional `master-route.ps1` integration (lines 21-38) enables dynamic skill routing based on hint analysis.

## Frequently Asked Questions

### What happens if I omit the -CaseName parameter?

The script automatically generates a unique directory name by combining a slugified version of the `-Hint` text (or the literal "case") with a timestamp, as implemented in lines 27-33 of `case-init.ps1`. This ensures no existing case is accidentally overwritten.

### How does the script validate the case directory name?

The script enforces a whitelist regex at lines 38-42 that rejects path separators, trailing dots or spaces, control characters, and wildcard symbols. If the `-CaseName` fails this check, the script terminates before writing any files to disk.

### Can I create a case without network connectivity?

Yes. The `-NetworkProfile` parameter accepts an `offline` mode, and the script itself requires no external network calls to generate the directory structure. All file operations are local, though you may optionally invoke `master-route.ps1` if it exists locally.

### What is the role of master-route.ps1 in case creation?

`master-route.ps1` acts as an optional skill router. When provided a `-Hint`, `case-init.ps1` executes this script (lines 21-38) to resolve the hint to a specific [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file path. The resolved path is then embedded in the generated [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md), providing analysts with a contextual starting point for the investigation.