Integrating Python with leading computer forensics platforms / Chet Hosmer.

Format:

Book

Author/Creator:

Hosmer, Chet, author.

Language:

English

Subjects (All):

Python (Computer program language).

Computer crimes--Investigation.

Computer crimes.

Physical Description:

1 online resource (218 pages) : illustrations, photographs

Edition:

1st edition

Place of Publication:

Amsterdam, [Netherlands] : Syngress, 2017.

System Details:

text file

Summary:

Integrating Python with Leading Computer Forensic Platforms takes a definitive look at how and why the integration of Python advances the field of digital forensics. In addition, the book includes practical, never seen Python examples that can be immediately put to use. Noted author Chet Hosmer demonstrates how to extend four key Forensic Platforms using Python, including EnCase by Guidance Software, MPE+ by AccessData, The Open Source Autopsy/SleuthKit by Brian Carrier and WetStone Technologies, and Live Acquisition and Triage Tool US-LATT. This book is for practitioners, forensic investigators, educators, students, private investigators, or anyone advancing digital forensics for investigating cybercrime. Additionally, the open source availability of the examples allows for sharing and growth within the industry. This book is the first to provide details on how to directly integrate Python into key forensic platforms. Provides hands-on tools, code samples, detailed instruction, and documentation that can be immediately put to use Shows how to integrate Python with popular digital forensic platforms, including EnCase, MPE+, The Open Source Autopsy/SleuthKit, and US-LATT Presents complete coverage of how to use Open Source Python scripts to extend and modify popular digital forensic Platforms

Contents:

Front Cover

Integrating Python with Leading Computer Forensics Platforms

Copyright

Dedication

Contents

Author Biography

Preface

Acknowledgments

Chapter 1: Integrating Python With Forensics Platforms

Introduction

What Is the Python Value Proposition for Forensics?

Resources

Books

Online Resources and Tutorials

learnpython.org

python.org/about/gettingstarted/

CS for All: Introduction to Computer Science and Python Programming

Formal Courses

What Are the Possible Integration Points and Methods?

Preprocessing

Postprocessing

Direct API Integration

Secondary Information Gathering

Secondary Processing of Hard Problems

Why Open Source?

What Forensic Platforms Are Covered?

Keys to Success

Review

Additional Resources

Chapter 2: Key Python Language Elements for Forensics

Font Usage

Quick Overview of the Python Environment

Installing Python for Windows

Setting Up a Python Integrated Development Environment

Python Forensics Source Code Template SRC-2-1.py

Script SRC-2-1.1py

Executing SRC-2-1

Basic Forensic Script SRC-2-2.py

Script SRC-2-2.py

Executing SRC-2-2.py

Next Steps

Challenge Problems

Chapter 3: Integrating Python With MPE+

MPE+ Basics

Launching the pythonScripter

Connecting the Dots … MPE+ with Python

Building and MPE+ Python Template

PF_MPE_PARAMETERS

PF_MPE_BASIC.py

Creating a HashSearch MPE+ Python Script

Executing a Hash Search

Chapter 4: Integrating Python With EnCase/EnScripts

EnCase Integration Points

EnCase File Viewer Integration

EnCase: Configuring a File Viewer

EnCase: Launching a Python File Viewer

pyBasic.py Script.

pyBasic.py

EnCase: Launching Python Using an EnScript

SelectedFiles EnScript Details

pyEnscript.py Details

Chapter 5: Integrating Python With Leading Forensic Platforms

US-LATT Configuration

US-LATT Acquisition Walk-Through

US-LATT Evidence Structure

Postprocessing of US-LATT Acquisition

memScanner.py

pyDiscover.py

Full Execution of memScanner.py

Chapter 6: Integrating Python With Leading Forensic Platforms

Integrating Python With Autopsy

The Report Module

What Does ProperNames.py Do?

properNames.py

Executing the Proper Names Script

Chapter 7: Future Look and an Integration Challenge Problem

The Future

Challenge Problem pyMP3.py

What Makes MP3 Attractive for Data Hiding?

pyMP3.py Python Script

Executing pyMP3.py

Index

Back Cover.

Notes:

Includes bibliographical references at the end of each chapters and index.

Description based on print version record.

ISBN:

9780128099506

012809950X

OCLC:

1202027414