Python forensics: a workbench for inventing and sharing digital forensic technology

Front Cover; Python Forensics: A Workbench for Inventing and Sharing Digital Forensic Technology; Copyright; Dedication; Acknowledgments; Endorsements; Contents; List of figures; About the Author; About the Technical Editor; Foreword; Preface; Intended Audience; Prerequisites; Reading this Book; Supported Platforms; Download Software; Comments, Questions, and Contributions; Chapter 1: Why Python Forensics?; Introduction; Cybercrime investigation challenges; How can the Python programming environment help meet these challenges?; Global support for Python; Open source and platform independence.

Lifecycle positioningCost and barriers to entry; Python and the Daubert evidence standard; Organization of the book; Chapter review; Summary questions; Additional Resources; Chapter 2: Setting up a Python Forensics Environment; Introduction; Setting up a python forensics environment; The right environment; The Python Shell; Choosing a python version; Installing python on windows; Python packages and modules; The Python Standard Library; What is included in the standard library?; Built-in functions; hex() and bin(); range(); Other built-in functions; Built-in constants; Built-in types.

Built-in exceptionsFile and directory access; Data compression and archiving; File formats; Cryptographic services; Operating system services; Standard Library summary; Third-party packages and modules; The natural language toolkit [NLTK]; Twisted matrix [TWISTED]; Integrated development environments; What are the options?; IDLE; WingIDE; Python running on Ubuntu Linux; Python on mobile devices; iOS Python app; Windows 8 phone; A virtual machine; Chapter review; Summary questions; Looking ahead; Additional Resources; Chapter 3: Our First Python Forensics App; Introduction.

Naming conventions and other considerationsConstants; Local variable name; Global variable name; Functions name; Object name; Module; Class names; Our first application ``one-way file system hashing ́ ́; Background; One-way hashing algorithms basic characteristics; Popular cryptographic hash algorithms?; What are the tradeoffs between one-way hashing algorithms?; What are the best-use cases for one-way hashing algorithms in forensics?; Fundamental requirements; Design considerations; Program structure; Main function; ParseCommandLine; WalkPath function; HashFile function; CSVWriter (class).

LoggerWriting the code; Code walk-through; Examining main-code walk-through; ParseCommandLine(); ValiditingDirectoryWritable; WalkPath; HashFile; CSVWriter; Full code listing pfish.py; Full code listing _pfish.py; Results presentation; Chapter review; Summary questions; Looking ahead; Additional Resources; Chapter 4: Forensic Searching and Indexing Using Python; Introduction; Keyword context search; How can this be accomplished easily in Python?; Fundamental requirements; Design considerations; Main function; ParseCommandLine; SearchWords function; PrintBuffer functions; logger.