Python Forensics
A Workbench for Inventing and Sharing Digital Forensic Technology
- 1st Edition - May 19, 2014
- Author: Chet Hosmer
- Language: English
- Paperback ISBN:9 7 8 - 0 - 1 2 - 4 1 8 6 7 6 - 7
- eBook ISBN:9 7 8 - 0 - 1 2 - 4 1 8 6 8 3 - 5
Python Forensics provides many never-before-published proven forensic modules, libraries, and solutions that can be used right out of the box. In addition, detailed instructi… Read more
Purchase options
Institutional subscription on ScienceDirect
Request a sales quotePython Forensics provides many never-before-published proven forensic modules, libraries, and solutions that can be used right out of the box. In addition, detailed instruction and documentation provided with the code samples will allow even novice Python programmers to add their own unique twists or use the models presented to build new solutions.
Rapid development of new cybercrime investigation tools is an essential ingredient in virtually every case and environment. Whether you are performing post-mortem investigation, executing live triage, extracting evidence from mobile devices or cloud services, or you are collecting and processing evidence from a network, Python forensic implementations can fill in the gaps.
Drawing upon years of practical experience and using numerous examples and illustrative code samples, author Chet Hosmer discusses how to:
- Develop new forensic solutions independent of large vendor software release schedules
- Participate in an open-source workbench that facilitates direct involvement in the design and implementation of new methods that augment or replace existing tools
- Advance your career by creating new solutions along with the construction of cutting-edge automation solutions to solve old problems
- Provides hands-on tools, code samples, and detailed instruction and documentation that can be put to use immediately
- Discusses how to create a Python forensics workbench
- Covers effective forensic searching and indexing using Python
- Shows how to use Python to examine mobile device operating systems: iOS, Android, and Windows 8
- Presents complete coverage of how to use Python scripts for network investigation
- Dedication
- Acknowledgments
- Endorsements
- List of figures
- About the Author
- About the Technical Editor
- Foreword
- Preface
- Intended audience
- Prerequisites
- Reading this book
- Supported platforms
- Download software
- Comments, questions, and contributions
- Chapter 1: Why Python Forensics?
- Abstract
- Introduction
- Cybercrime investigation challenges
- How can the Python programming environment help meet these challenges?
- Python and the Daubert evidence standard
- Organization of the book
- Chapter review
- Summary questions
- Chapter 2: Setting up a Python Forensics Environment
- Abstract
- Introduction
- Setting up a python forensics environment
- The right environment
- Choosing a python version
- Installing python on windows
- Python packages and modules
- What is included in the standard library?
- Third-party packages and modules
- Integrated development environments
- Python on mobile devices
- A virtual machine
- Chapter review
- Summary questions
- Looking ahead
- Chapter 3: Our First Python Forensics App
- Abstract
- Introduction
- Naming conventions and other considerations
- Our first application “one-way file system hashing”
- Code walk-through
- Results presentation
- Chapter review
- Summary questions
- Looking ahead
- Chapter 4: Forensic Searching and Indexing Using Python
- Abstract
- Introduction
- Keyword context search
- Code walk-through
- Results presentation
- Indexing
- Coding isWordProbable
- p-search complete code listings
- Chapter review
- Summary questions
- Chapter 5: Forensic Evidence Extraction (JPEG and TIFF)
- Abstract
- Introduction
- Code Walk-Through
- Chapter review
- Summary questions
- Chapter 6: Forensic Time
- Abstract
- Introduction
- Adding time to the equation
- The time module
- The Network Time Protocol
- Obtaining and installing the NTP Library ntplib
- World NTP Servers
- NTP Client Setup Script
- Chapter review
- Summary questions
- Chapter 7: Using Natural Language Tools in Forensics
- Abstract
- What is Natural Language Processing?
- Installing the Natural Language Toolkit and associated libraries
- Working with a corpus
- Experimenting with NLTK
- Creating a corpus from the Internet
- NLTKQuery application
- Chapter review
- Summary questions
- Chapter 8: Network Forensics: Part I
- Abstract
- Network investigation basics
- Captain Ramius: re-verify our range to target… one ping only
- Port scanning
- Chapter review
- Summary questions
- Chapter 9: Network Forensics: Part II
- Abstract
- Introduction
- Packet sniffing
- Raw sockets in Python
- Python Silent Network Mapping Tool (PSNMT)
- PSNMT source code
- Program execution and output
- Chapter review
- Summary question/challenge
- Chapter 10: Multiprocessing for Forensics
- Abstract
- Introduction
- What is multiprocessing?
- Python multiprocessing support
- Simplest multiprocessing example
- Multiprocessing File Hash
- Multiprocessing Hash Table generation
- Chapter review
- Summary question/challenge
- Chapter 11: Rainbow in the Cloud
- Abstract
- Introduction
- Putting the cloud to work
- Cloud options
- Creating rainbows in the cloud
- Password Generation Calculations
- Chapter review
- Summary question/challenge
- Chapter 12: Looking Ahead
- Abstract
- Introduction
- Where do we go from here?
- Conclusion
- Index
- No. of pages: 352
- Language: English
- Edition: 1
- Published: May 19, 2014
- Imprint: Syngress
- Paperback ISBN: 9780124186767
- eBook ISBN: 9780124186835
CH