Book Image

Learning Python for Forensics

By : Chapin Bryce
Book Image

Learning Python for Forensics

By: Chapin Bryce

Overview of this book

This book will illustrate how and why you should learn Python to strengthen your analysis skills and efficiency as you creatively solve real-world problems through instruction-based tutorials. The tutorials use an interactive design, giving you experience of the development process so you gain a better understanding of what it means to be a forensic developer. Each chapter walks you through a forensic artifact and one or more methods to analyze the evidence. It also provides reasons why one method may be advantageous over another. We cover common digital forensics and incident response scenarios, with scripts that can be used to tackle case work in the field. Using built-in and community-sourced libraries, you will improve your problem solving skills with the addition of the Python scripting language. In addition, we provide resources for further exploration of each script so you can understand what further purposes Python can serve. With this knowledge, you can rapidly develop and deploy solutions to identify critical information and fine-tune your skill set as an examiner.
Table of Contents (24 chapters)
Learning Python for Forensics
Credits
About the Authors
Acknowledgments
About the Reviewer
www.PacktPub.com
Preface
Index

Variables


We can assign values to variables using the data types we just covered. By assigning values to variables we can refer to that value, which could be a large 100 element list, by its variable name. This not only saves the programmer from re-typing the value over and over again, but also helps enhance the readability of the code and allows us to change the values of a variable over time. Throughout the chapter, we have already assigned objects to variables using the "=" sign. Variable names can technically be anything, although we recommend the following guidelines:

  • Variable names should be short and descriptive of the stored content or purpose.

  • Begin with a letter or underscore.

  • Constant variables should be denoted by capitalized words.

  • Dynamic variables should be lowercase words separated by underscores.

  • Never be one of the following or any Python reserved name: input, output, tmp, temp, in, for, next, file, True, False, None, str, int, list, and so on.

  • Never include a space in a variable name. Python thinks two variables are being defined and will raise a syntax error. Use underscores to separate words.

Generally, programmers use memorable and descriptive names that indicate the data they hold. For example, in a script that prompts for the phone number of the user, the variable should be phone_number, which clearly indicates the purpose and contents of this variable. Another popular naming style is CamelCase where every word is capitalized. This naming convention is often used in conjunction with function and class names.

Variable assignment allows the value to be modified as the script runs. The general rule of thumb is to assign a value to a variable if it will be used again. Let's practice by creating variables and assigning them data types that we have just learned about. While this is simple, we recommend following along in the interactive prompt to get into the habit of assigning variables. In the following first example, we assign a string to a variable before printing the variable.

>>> hello_world = "Hello World!"
>>> print hello_world
Hello World!

The second example introduces some new operators. First, we assign the integer 5 to the variable our_number. Then we use the plus-gets (+=) as a built-in shorthand for our_number = our_number + 20. In addition to plus-gets, we have minus-gets (-=), multiply-gets (*=), and divide-gets (/=).

>>> our_number = 5
>>> our_number += 20
>>> print our_number
25

In the following code block we assign a series of variables before printing them. The data types used for our variables are string, integer, float, unicode, and Boolean, respectively.

>>> BOOK_TITLE = 'Learning Python for Forensics'
>>> edition = 1
>>> python_version = 2.7
>>> AUTHOR_NAMES = u'Preston Miller, Chapin Bryce'
>>> is_written_in_english = True
>>> print BOOK_TITLE
Learning Python for Forensics
>>> print AUTHOR_NAMES
Preston Miller, Chapin Bryce
>>> print edition
1
>>> print python_version
2.7
>>> print is_written_in_english
True

Notice the BOOK_TITLE and AUTHOR_NAMES variables. When a variable is static, or non-changing, throughout the execution of a script, it is referred to as a constant variable. Unlike other programming languages, there is not a built-in method for protecting constants from being overwritten, so we use naming conventions to assist in reminding us not to replace the value. While some variables, such as the edition of the book, language, or version of Python might change, the title and authors should be constants (we hope). If there is ever confusion when it comes to naming and styling conventions in Python try running the following statement in an interpreter.

>>>import this 

As we saw previously, we can use the split() method on a string to convert it into a list. We can also convert a list into a string using the join method. This method follows a string containing the desired common denominator and the list as its only argument. In the following example, we take a list containing two strings and join them into one string where the elements are separated by a comma.

>>> print ', '.join(["This string is really long", " It should probably be on two lines."])
This string is really long, It should probably be on two lines.