# How to Initialize a Case with case-init.ps1 in reverse-skill

> Learn how to initialize a case with case-init.ps1 in reverse-skill. This script creates a standardized case directory with subfolders and initialized markdown documents for your investigation.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-01

---

**The `case-init.ps1` script creates a standardized case directory under `work/<CaseName>` containing subfolders for evidence, notes, and reports, plus initialized markdown documents for scope, timeline, and workitems based on your supplied parameters.**

The `case-init.ps1` utility in the zhaoxuya520/reverse-skill repository serves as the primary entry point for bootstrapping new investigations. This PowerShell script automates the creation of a workspace that adheres to the reverse-skill operational contract, ensuring consistent directory structures and documentation standards across all cases. When you initialize a case with `case-init.ps1`, the script resolves authentication status, network profiles, and in-scope assets before generating the required markdown artifacts.

## Parameter Overview

The script accepts several command-line switches that define the case context. These parameters control everything from directory naming to operational readiness flags.

Key parameters include:

- **`-Hint`**: A descriptive string used to auto-generate the case name when `-CaseName` is omitted. The script converts this to a lowercase slug with non-alphanumeric characters replaced by hyphens.
- **`-CaseName`**: An explicit name for the case directory. If omitted, the script constructs one using a timestamp prefix (`yyyyMMdd-HHmmss`) followed by the processed hint.
- **`-AuthGranted`**: A switch indicating authorization has been obtained for the target assets.
- **`-TargetUrl`**: The primary URL under investigation, automatically added to the in-scope assets list.
- **`-InScopeAssets`**: Additional IP addresses, hostnames, or URLs to include in the scope.
- **`-NetworkProfile`**: The network operational mode (e.g., `offline`, `authorized_target_only`). Supports common aliases like `lab` and `auth`.
- **`-ReadyForAct`**: Forces the `ready_for_act` flag to true, though the script emits warnings if prerequisites are missing.

## Initialization Workflow

Understanding the internal workflow helps you anticipate how the script resolves conflicts and populates the generated files.

### Case Name Derivation and Directory Creation

When you execute `skills/scripts/case-init.ps1`, the first operation processes the naming parameters. If you omit `-CaseName`, the script generates a slug from the `-Hint` value and prefixes it with the current timestamp in `yyyyMMdd-HHmmss` format.

The script then creates the directory structure at `<PackageRoot>/work/<CaseName>` with three subdirectories:

- `evidence/` – Storage for collected artifacts and raw data
- `notes/` – Working notes and interim findings
- `report/` – Final deliverables and structured output

### Authentication and Asset Resolution

The script resolves the `authStatusResolved` value using a strict precedence order: explicit `-AuthStatus` parameter first, then the `-AuthGranted` switch, falling back to `pending` as the default. Invalid values trigger a warning and revert to the default.

For asset collection, the script aggregates values from `-TargetUrl` and any `-InScopeAssets` entries. If you provide neither but the hint contains a URL, the script infers the host component and adds it to the scope automatically.

### Network Profile Selection

The network profile logic defaults to `offline` for safety. However, if you have provided in-scope assets and set `-AuthGranted`, the script automatically switches the profile to `authorized_target_only`. The script normalizes common aliases—such as mapping `lab` to `offline` and `auth` to `authorized_target_only`—to ensure consistent values in the generated [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md).

### Ready-for-Act Validation

The `ready_for_act` boolean determines whether the case meets the minimum requirements for active operations. According to the validation logic in `skills/scripts/case-init.ps1`, the case is marked ready only when three conditions are met simultaneously: authentication status is granted, the assets list is non-empty, and the network mode is not `offline`.

You can override this check using the `-ReadyForAct` switch, but the script will emit warnings if the prerequisites remain unfulfilled.

### Markdown Artifact Generation

In the final phase, the script writes four UTF-8 encoded markdown files into the case root:

- **[`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md)** – Defines the operational contract, including auth status, assets, and network profile
- **[`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md)** – An append-only activity log for tracking investigation milestones
- **[`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md)** – A structured table of tasks and findings
- **[`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md)** – A quick-start guide with next steps and file descriptions

These files follow the schemas defined in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) and [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md).

## Practical Usage Examples

The following commands demonstrate common initialization patterns for the zhaoxuya520/reverse-skill framework.

Create a quick offline case for static analysis with an explicit name:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -Hint "static analysis" `
    -CaseName static-case

```

Initialize an authorized web penetration testing case with explicit target URLs:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -Hint "web pentest" `
    -AuthGranted `
    -TargetUrl "https://app.example/" `
    -NetworkProfile authorized_target_only

```

Set up a lab-only reverse engineering case with specific assets and forced readiness:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -Hint "lab reverse-engineering" `
    -InScopeAssets "192.168.10.5" `
    -AuthGranted `
    -ReadyForAct

```

Each command creates a directory such as `work/20230801-123456-static-analysis` (when using auto-naming) containing the standard folder structure and initialized markdown files.

## Optional Master-Route Integration

If `skills/scripts/master-route.ps1` exists in your installation, `case-init.ps1` can invoke it during initialization. When you provide a hint and the master-route script is present, the initialization process discovers the primary skill and its identifier, inserting these values into the generated [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md). This integration ensures your case is pre-configured with the correct skill context before you begin evidence collection.

## Summary

- **`case-init.ps1`** is the entry point for creating standardized case directories in the zhaoxuya520/reverse-skill repository.
- The script automatically generates case names from timestamps and hint slugs when `-CaseName` is omitted.
- Directory creation follows a strict structure: `evidence/`, `notes/`, `report/`, plus four markdown boilerplate files.
- Authentication status resolves in order: explicit parameter, `-AuthGranted` switch, then default `pending`.
- The `ready_for_act` flag requires granted authentication, non-empty assets, and a non-offline network mode.
- Network profiles support aliases and auto-adjust based on authorization and asset presence.

## Frequently Asked Questions

### What happens if I don't specify a -CaseName?

The script constructs a case name by taking the current timestamp in `yyyyMMdd-HHmmss` format and appending a slug derived from the `-Hint` parameter. This slug converts the hint to lowercase and replaces all non-alphanumeric characters with hyphens, ensuring valid directory names.

### How does the script determine if a case is ready for active operations?

The `ready_for_act` flag evaluates to true only when three conditions align: the resolved authentication status is `granted`, the in-scope assets list contains at least one entry, and the network profile is not set to `offline`. You can force this flag with `-ReadyForAct`, but the script will warn you if the underlying prerequisites are not satisfied.

### Can I use shorthand values for network profiles?

Yes. The script normalizes common aliases before writing to [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md). For example, `lab` maps to `offline` and `auth` maps to `authorized_target_only`. If you omit the parameter entirely, the script defaults to `offline` unless you have specified assets and granted authorization, in which case it switches to `authorized_target_only`.

### Which files are generated inside the new case directory?

The script creates three subdirectories (`evidence`, `notes`, `report`) and four markdown files: [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) (the operational contract), [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) (activity tracking), [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) (task management), and [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) (quick-start instructions). All files are written in UTF-8 encoding and populated with template content reflecting your initialization parameters.