Chapter 1, Setting Up the Lab and Introduction to Python ctypes, covers how to set up your environment to follow the examples that are provided in this book. We will take a look at the various Python modules that support our forensic analyses. With ctypes, we provide the means to go beyond Python modules and leverage the capabilities of native system libraries.

Chapter 2, Forensic Algorithms, provides you with the digital equivalent of taking fingerprints. Just like in the case of classic fingerprints, we will show you how to compare the digital fingerprints with a huge registry of the known good and bad samples. This will support you in focusing your analysis and providing a proof of forensical soundness.

Chapter 3, Using Python for Windows and Linux Forensics, is the first step on your journey to understanding digital evidence. We will provide examples to detect signs of compromise on Windows and Linux systems. We will conclude the chapter with an example on how to use machine learning algorithms in the forensic analysis.

Chapter 4, Using Python for Network Forensics, is all about capturing and analyzing network traffic. With the provided tools, you can search and analyze the network traffic for signs of exfiltration or signature of malware communication.

Chapter 5, Using Python for Virtualization Forensics, explains how modern virtualization concepts can be used by the attacker and forensic analyst. Consequently, we will show how to find traces of malicious behavior on the hypervisor level and utilize the virtualization layer as a reliable source of forensic data.

Chapter 6, Using Python for Mobile Forensics, will give you an insight on how to retrieve and analyze forensic data from mobile devices. The examples will include analyzing Android devices as well as Apple iOS devices.

Chapter 7, Using Python for Memory Forensics, demonstrates how to retrieve memory snapshots and analyze these RAM images forensically with Linux and Android. With the help of tools such as LiME and Volatility, we will demonstrate how to extract information from the system memory.

All you need for this book is a Linux workstation with a Python 2.7 environment and a working Internet connection. Chapter 1, Setting Up the Lab and Introduction to Python ctypes, will guide you through the installation of the additional Python modules and tools. All of our used tools are freely available from the Internet. The source code of our samples is available from Packt Publishing.

To follow the examples of Chapter 5, Using Python for Virtualization Forensics, you may want to set up a virtualization environment with VMware vSphere. The required software is available from VMware as time-limited trial version without any functional constraints.

While not strictly required, we recommend trying some of the examples of Chapter 6, Using Python for Mobile Forensics, on discarded mobile devices. For your first experiments, please refrain from using personal or business phones that are actually in use.

This book is for IT administrators, IT operations, and analysts who want to gain profound skills in the collection and analysis of digital evidence. If you are already a forensic expert, this book will help you to expand your knowledge in new areas such as virtualization or mobile devices.

To get the most out of this book, you should have decent skills in Python and understand at least some inner workings of your forensic targets. For example, some file system details.

In this book, you will find a number of text styles that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "Note that in the case of Windows, msvcrt is the MS standard C library containing most of the standard C functions and uses the cdecl calling convention (on Linux systems, the similar library would be libc.so.6)."

A block of code is set as follows:

def multi_hash(filename):
    """Calculates the md5 and sha256 hashes
       of the specified file and returns a list
       containing the hash sums as hex strings."""

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d"></Provider>
<EventID Qualifiers="">4724</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>

Any command-line input or output is written as follows:

user@lab:~$ virtualenv labenv
New python executable in labenv/bin/python
Installing setuptools, pip...done.

New terms and important words are shown in bold. Words that you see on the screen, for example, in menus or dialog boxes, appear in the text like this: "When asked to Select System Logs, ensure that all log types are selected."

Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or disliked. Reader feedback is important for us as it helps us develop titles that you will really get the most out of.

To send us general feedback, simply e-mail <[email protected]>, and mention the book's title in the subject of your message.

If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors.

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.