Sign In Start Free Trial

Python Digital Forensics Cookbook

By : Chapin Bryce, Miller

5 (2)

Python Digital Forensics Cookbook

5 (2)

By: Chapin Bryce, Miller

Overview of this book

Technology plays an increasingly large role in our daily lives and shows no sign of stopping. Now, more than ever, it is paramount that an investigator develops programming expertise to deal with increasingly large datasets. By leveraging the Python recipes explored throughout this book, we make the complex simple, quickly extracting relevant information from large datasets. You will explore, develop, and deploy Python code and libraries to provide meaningful results that can be immediately applied to your investigations. Throughout the Python Digital Forensics Cookbook, recipes include topics such as working with forensic evidence containers, parsing mobile and desktop operating system artifacts, extracting embedded metadata from documents and executables, and identifying indicators of compromise. You will also learn to integrate scripts with Application Program Interfaces (APIs) such as VirusTotal and PassiveTotal, and tools such as Axiom, Cellebrite, and EnCase. By the end of the book, you will have a sound understanding of Python and how you can use it to process artifacts in your investigations.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Sections

Conventions

Reader feedback

Customer support

Free Chapter

Essential Scripting and File Information Recipes

Essential Scripting and File Information Recipes

Introduction

Handling arguments like an adult

Iterating over loose files

Recording file attributes

Copying files, attributes, and timestamps

Hashing files and data streams

Keeping track with a progress bar

Logging results

Multiple hands make light work

Creating Artifact Report Recipes

Creating Artifact Report Recipes

Introduction

Using HTML templates

Creating a paper trail

Working with CSVs

Visualizing events with Excel

Auditing your work

A Deep Dive into Mobile Forensic Recipes

A Deep Dive into Mobile Forensic Recipes

Introduction

Parsing PLIST files

Handling SQLite databases

Identifying gaps in SQLite databases

Processing iTunes backups

Putting Wi-Fi on the map

Digging deep to recover messages

Extracting Embedded Metadata Recipes

Extracting Embedded Metadata Recipes

Introduction

Extracting audio and video metadata

The big picture

Mining for PDF metadata

Reviewing executable metadata

Reading office document metadata

Integrating our metadata extractor with EnCase

Networking and Indicators of Compromise Recipes

Networking and Indicators of Compromise Recipes

Introduction

Getting a jump start with IEF

Coming into contact with IEF

Beautiful Soup

Going hunting for viruses

Gathering intel

Totally passive

Reading Emails and Taking Names Recipes

Reading Emails and Taking Names Recipes

Introduction

Parsing EML files

Viewing MSG files

Ordering Takeout

What’s in the box?!

Parsing PST and OST mailboxes

Log-Based Artifact Recipes

Log-Based Artifact Recipes

Introduction

About time

Parsing IIS web logs with RegEx

Going spelunking

Interpreting the daily.out log

Adding daily.out parsing to Axiom

Scanning for indicators with YARA

Working with Forensic Evidence Container Recipes

Working with Forensic Evidence Container Recipes

Introduction

Opening acquisitions

Gathering acquisition and media information

Iterating through files

Processing files within the container

Searching for hashes

Exploring Windows Forensic Artifacts Recipes - Part I

Exploring Windows Forensic Artifacts Recipes - Part I

Introduction

One man's trash is a forensic examiner's treasure

A sticky situation

Reading the registry

Gathering user activity

The missing link

Searching high and low

Exploring Windows Forensic Artifacts Recipes - Part II

Exploring Windows Forensic Artifacts Recipes - Part II

Introduction

Parsing prefetch files

A series of fortunate events

Indexing internet history

Shadow of a former self

Dissecting the SRUM database

Customer Reviews

5 (2)

5 star

100%

4 star

0

3 star

0

2 star

0

1 star

0

Going hunting for viruses

Recipe Difficulty: Medium

Python Version: 3.5

Operating System: Any

VirusShare is the largest privately owned collection of malware samples, with over 29.3 million samples and counting. One of the great benefits of VirusShare, besides the literal cornucopia of malware that is every malware researcher's dream, is the list of malware hashes which is made freely available. We can use these hashes to a create a very comprehensive hash set and leverage that in casework to identify potentially malicious files.

To learn more about and use VirusShare, visit the website https://virusshare.com/.

In this recipe, we demonstrate how to automate downloading lists of hashes from VirusShare to create a newline-delimited hash list. This list can be used by forensic tools, such as X-Ways, to create a HashSet. Other forensic tools, EnCase, for example, can use this...

Search

Your notes and bookmarks