Book Overview & Buying
Table Of Contents

Python Digital Forensics Cookbook

By : Chapin Bryce, Preston Miller

5 (2)

Buy this Book

Python Digital Forensics Cookbook

5 (2)

By: Chapin Bryce, Preston Miller

Buy this Book

Overview of this book

Technology plays an increasingly large role in our daily lives and shows no sign of stopping. Now, more than ever, it is paramount that an investigator develops programming expertise to deal with increasingly large datasets. By leveraging the Python recipes explored throughout this book, we make the complex simple, quickly extracting relevant information from large datasets. You will explore, develop, and deploy Python code and libraries to provide meaningful results that can be immediately applied to your investigations. Throughout the Python Digital Forensics Cookbook, recipes include topics such as working with forensic evidence containers, parsing mobile and desktop operating system artifacts, extracting embedded metadata from documents and executables, and identifying indicators of compromise. You will also learn to integrate scripts with Application Program Interfaces (APIs) such as VirusTotal and PassiveTotal, and tools such as Axiom, Cellebrite, and EnCase. By the end of the book, you will have a sound understanding of Python and how you can use it to process artifacts in your investigations.

Preface

What this book covers

What you need for this book

Who this book is for

Sections

Conventions

Reader feedback

Customer support

Free Chapter

Essential Scripting and File Information Recipes

Introduction

Handling arguments like an adult

Iterating over loose files

Recording file attributes

Copying files, attributes, and timestamps

Hashing files and data streams

Keeping track with a progress bar

Logging results

Multiple hands make light work

Creating Artifact Report Recipes

Introduction

Using HTML templates

Creating a paper trail

Working with CSVs

Visualizing events with Excel

Auditing your work

A Deep Dive into Mobile Forensic Recipes

Introduction

Parsing PLIST files

Handling SQLite databases

Identifying gaps in SQLite databases

Processing iTunes backups

Putting Wi-Fi on the map

Digging deep to recover messages

Extracting Embedded Metadata Recipes

Introduction

Extracting audio and video metadata

The big picture

Mining for PDF metadata

Reviewing executable metadata

Reading office document metadata

Integrating our metadata extractor with EnCase

Networking and Indicators of Compromise Recipes

Introduction

Getting a jump start with IEF

Coming into contact with IEF

Beautiful Soup

Going hunting for viruses

Gathering intel

Totally passive

Reading Emails and Taking Names Recipes

Introduction

Parsing EML files

Viewing MSG files

Ordering Takeout

What’s in the box?!

Parsing PST and OST mailboxes

Log-Based Artifact Recipes

Introduction

About time

Parsing IIS web logs with RegEx

Going spelunking

Interpreting the daily.out log

Adding daily.out parsing to Axiom

Scanning for indicators with YARA

Working with Forensic Evidence Container Recipes

Introduction

Opening acquisitions

Gathering acquisition and media information

Iterating through files

Processing files within the container

Searching for hashes

Exploring Windows Forensic Artifacts Recipes - Part I

Introduction

One man's trash is a forensic examiner's treasure

A sticky situation

Reading the registry

Gathering user activity

The missing link

Searching high and low

Exploring Windows Forensic Artifacts Recipes - Part II

Introduction

Parsing prefetch files

A series of fortunate events

Indexing internet history

Shadow of a former self

Dissecting the SRUM database

Identifying gaps in SQLite databases

Recipe Difficulty: Easy

Python Version: 2.7 or 3.5

Operating System: Any

This recipe will demonstrate how to programmatically identify missing entries for a given table by using its primary key. This technique allows us to identify records that are no longer active in the database. We will use this to identify which and how many messages have been deleted from an iPhone SMS database. This, however, will work with any table that uses an auto-incrementing primary key.

To learn more about SQLite tables and primary keys, visit https://www.sqlite.org/lang_createtable.html.

One fundamental idea governing SQLite databases and their tables are primary keys. A primary key is typically a column that serves as a unique integer for a particular row in the table. A common implementation is the auto-incrementing primary key, starting typically at 1 for the...

Tech Concepts

Programming languages

Tech Tools