Sign In Start Free Trial

Python Digital Forensics Cookbook

By : Chapin Bryce, Miller

5 (2)

Python Digital Forensics Cookbook

5 (2)

By: Chapin Bryce, Miller

Overview of this book

Technology plays an increasingly large role in our daily lives and shows no sign of stopping. Now, more than ever, it is paramount that an investigator develops programming expertise to deal with increasingly large datasets. By leveraging the Python recipes explored throughout this book, we make the complex simple, quickly extracting relevant information from large datasets. You will explore, develop, and deploy Python code and libraries to provide meaningful results that can be immediately applied to your investigations. Throughout the Python Digital Forensics Cookbook, recipes include topics such as working with forensic evidence containers, parsing mobile and desktop operating system artifacts, extracting embedded metadata from documents and executables, and identifying indicators of compromise. You will also learn to integrate scripts with Application Program Interfaces (APIs) such as VirusTotal and PassiveTotal, and tools such as Axiom, Cellebrite, and EnCase. By the end of the book, you will have a sound understanding of Python and how you can use it to process artifacts in your investigations.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Sections

Conventions

Reader feedback

Customer support

Free Chapter

Essential Scripting and File Information Recipes

Essential Scripting and File Information Recipes

Introduction

Handling arguments like an adult

Iterating over loose files

Recording file attributes

Copying files, attributes, and timestamps

Hashing files and data streams

Keeping track with a progress bar

Logging results

Multiple hands make light work

Creating Artifact Report Recipes

Creating Artifact Report Recipes

Introduction

Using HTML templates

Creating a paper trail

Working with CSVs

Visualizing events with Excel

Auditing your work

A Deep Dive into Mobile Forensic Recipes

A Deep Dive into Mobile Forensic Recipes

Introduction

Parsing PLIST files

Handling SQLite databases

Identifying gaps in SQLite databases

Processing iTunes backups

Putting Wi-Fi on the map

Digging deep to recover messages

Extracting Embedded Metadata Recipes

Extracting Embedded Metadata Recipes

Introduction

Extracting audio and video metadata

The big picture

Mining for PDF metadata

Reviewing executable metadata

Reading office document metadata

Integrating our metadata extractor with EnCase

Networking and Indicators of Compromise Recipes

Networking and Indicators of Compromise Recipes

Introduction

Getting a jump start with IEF

Coming into contact with IEF

Beautiful Soup

Going hunting for viruses

Gathering intel

Totally passive

Reading Emails and Taking Names Recipes

Reading Emails and Taking Names Recipes

Introduction

Parsing EML files

Viewing MSG files

Ordering Takeout

What’s in the box?!

Parsing PST and OST mailboxes

Log-Based Artifact Recipes

Log-Based Artifact Recipes

Introduction

About time

Parsing IIS web logs with RegEx

Going spelunking

Interpreting the daily.out log

Adding daily.out parsing to Axiom

Scanning for indicators with YARA

Working with Forensic Evidence Container Recipes

Working with Forensic Evidence Container Recipes

Introduction

Opening acquisitions

Gathering acquisition and media information

Iterating through files

Processing files within the container

Searching for hashes

Exploring Windows Forensic Artifacts Recipes - Part I

Exploring Windows Forensic Artifacts Recipes - Part I

Introduction

One man's trash is a forensic examiner's treasure

A sticky situation

Reading the registry

Gathering user activity

The missing link

Searching high and low

Exploring Windows Forensic Artifacts Recipes - Part II

Exploring Windows Forensic Artifacts Recipes - Part II

Introduction

Parsing prefetch files

A series of fortunate events

Indexing internet history

Shadow of a former self

Dissecting the SRUM database

Customer Reviews

5 (2)

5 star

100%

4 star

0

3 star

0

2 star

0

1 star

0

Introduction

Microsoft Windows is one of the most common operating systems found on machines during forensic analysis. This has led to a large effort in the community over the past two decades to develop, share, and document artifacts deposited by this operating system for use in forensic casework.

In this chapter, we continue to look at various Windows artifacts and how to process them using Python. We will leverage the framework we developed in Chapter 8, Working with Forensic Evidence Container Recipes to process these artifacts directly from forensic acquisitions. We'll use various libyal libraries to handle the underlying processing of various files, including pyevt, pyevtx, pymsiecf, pyvshadow, and pyesedb. We'll also explore how to process prefetch files using struct and a file format table of offsets and data types of interest. Here's what we'll learn...

Search

Your notes and bookmarks