Book Image

Learning Python for Forensics

By : Chapin Bryce
Book Image

Learning Python for Forensics

By: Chapin Bryce

Overview of this book

This book will illustrate how and why you should learn Python to strengthen your analysis skills and efficiency as you creatively solve real-world problems through instruction-based tutorials. The tutorials use an interactive design, giving you experience of the development process so you gain a better understanding of what it means to be a forensic developer. Each chapter walks you through a forensic artifact and one or more methods to analyze the evidence. It also provides reasons why one method may be advantageous over another. We cover common digital forensics and incident response scenarios, with scripts that can be used to tackle case work in the field. Using built-in and community-sourced libraries, you will improve your problem solving skills with the addition of the Python scripting language. In addition, we provide resources for further exploration of each script so you can understand what further purposes Python can serve. With this knowledge, you can rapidly develop and deploy solutions to identify critical information and fine-tune your skill set as an examiner.
Table of Contents (24 chapters)
Learning Python for Forensics
Credits
About the Authors
Acknowledgments
About the Reviewer
www.PacktPub.com
Preface
Index

The Python installation folder


In this section, we will discuss the structure of the Python installation directory, to better understand its purpose and how to take advantage of it. On Windows, Python installs itself in the root of the C:\ directory in the Python27 folder. If multiple versions of Python exist on the system, Python 2.7 is installed in the C:\Python\2.7 folder. Other numbered versions of Python would exist under the C:\Python folder.

Within the installation directory, there are a number of folders and files. Notably, the python.exe and pythonw.exe executables exist within the directory. The pythonw.exe executable is the same as python.exe with the exception that a terminal window does not appear when running a script. We might, for example, use pythonw.exe when running a GUI-based Python script where we do not need to see a terminal because all interaction happens within the GUI.

Let's now discuss the contents and purpose of the directories in the Python installation folder. For our purposes, we will highlight some of the more important folders. The following screenshot shows the contents of the Python installation directory.

The Doc folder

The Doc folder contains compiled HTML help files, which document the version(s) of Python installed and contain homologous contents as the online Python documentation. This can be a very helpful resource when developing scripts in an offline environment. Multiple documentation files will exist for the different subversions of Python installed. For example, Python 2.7.6 and Python 2.7.10 will have separate help files detailing the different subversions of Python 2.7.X.

The Lib folder

The Lib folder contains the standard library and third-party modules. Standard library modules are present in the Lib folder. Third-party modules are located within the site-packages subdirectory.

The Scripts folder

The Scripts folder contains the pip, easy_install, wheel, and other utility executables. The pip executable needs no introduction as it has been our go to method to install third-party Python modules. The easy_install executable can also be used to install Python modules. Pip came after easy_install and introduced additional features making it the more compelling option. However, we have used easy_install to install modules that pip was unable to locate or install successfully. A comparison between the two tools can be read at http://python-packaging-user-guide.readthedocs.org/en/latest/pip_easy_install/.

The Python interpreter

Running behind the scenes and executing Python code is the Python Interpreter. The Python interpreter is responsible for converting source code (.py files) into faster executing byte code (.pyc files) and interpreting the byte code instructions with the Python Virtual Machine (PVM). The interpreter will skip the initial byte code conversion if the file has not changed since the last byte code instructions were generated.

Once Python has been properly installed, an interactive prompt session can be launched by typing python on the command line or terminal. The interactive prompt is useful for testing smaller segments of code or experimenting with ideas. It is not recommended to write lengthy scripts in the interactive prompt. When code is executed within the prompt, source code is converted to byte code in memory, executed by the PVM, and then the byte code is discarded. Code written in the interactive prompt is not saved into a .py or .pyc file.

Python modules

Now we know how and why Python optimizes our code each time we execute a script. How does the Python Interpreter know which script to run when we import a module? You have already learned how to import our own code by turning a normal directory into a Python package, in Chapter 2, Python Fundamentals by including an __init__.py file. But what about when we import a module that is not in an immediate subdirectory?

There are a number of different methods of installing Python modules. Python modules can be installed with .whl (wheel), .egg (egg), bundled with a setup.py file, or using automated solutions such as pip. Irrespective of the method, these modules install the same contents on the system.

Each time Python starts, it automatically runs the site module, which among other things, adds the Lib/site-packages folder to the sys.path variable. The sys.path is also initialized by the PYTHONPATH variable. When we try to import a module, Python searches within the directories listed in the sys.path variable. Within these directories it looks for .py, .pyc, and .pyd files with the same name of the specified module.

In fact, we can copy a module's files and transfer them to another system (running the same OS, architecture, and version of Python), and that module will have been successfully installed. This can be a convenient means of providing required third-party modules with your code, so it executes for the end user without requiring further action upon their part. When copying we must be sure to transfer all required files, dependencies, and DLLs (if present). Offline installation is usually available through a setup.py file.