Mastering Python forensics : master the art of digital forensics and analysis with Python First Published October 2015 Edition Uhrmann 2024 scribd download
Mastering Python forensics : master the art of digital forensics and analysis with Python First Published October 2015 Edition Uhrmann 2024 scribd download
com
https://textbookfull.com/product/mastering-python-forensics-
master-the-art-of-digital-forensics-and-analysis-with-
python-first-published-october-2015-edition-uhrmann/
OR CLICK BUTTON
DOWNLOAD NOW
https://textbookfull.com/product/python-digital-forensics-cookbook-
effective-python-recipes-for-digital-investigations-1st-edition-
preston-miller/
textboxfull.com
https://textbookfull.com/product/digital-forensics-1st-edition-andre-
arnes-editor/
textboxfull.com
Practical Mobile Forensics A hands on guide to mastering
mobile forensics for the iOS Android and the Windows Phone
platforms 3rd Edition Rohit Tamma
https://textbookfull.com/product/practical-mobile-forensics-a-hands-
on-guide-to-mastering-mobile-forensics-for-the-ios-android-and-the-
windows-phone-platforms-3rd-edition-rohit-tamma/
textboxfull.com
https://textbookfull.com/product/mastering-large-datasets-with-python-
parallelize-and-distribute-your-python-code-1st-edition-john-t-
wolohan/
textboxfull.com
https://textbookfull.com/product/cybercrime-and-digital-forensics-an-
introduction-thomas-j-holt/
textboxfull.com
Every effort has been made in the preparation of this book to ensure
the accuracy of the information presented. However, the information
contained in this book is sold without warranty, either express or
implied. Neither the authors, nor Packt Publishing, and its dealers
and distributors will be held liable for any damages caused or
alleged to be caused directly or indirectly by this book.
Livery Place
35 Livery Street
ISBN 978-1-78398-804-4
www.packtpub.com
Credits
Authors
Reviewers
Richard Marsden
Puneet Narula
Yves Vandermeer
Commissioning Editor
Kartikey Pandey
Acquisition Editor
Sonali Vernekar
Shweta Pant
Technical Editor
Pranil Pathare
Copy Editor
Vibha Shukla
Project Coordinator
Shipra Chawhan
Proofreader
Safis Editing
Indexer
Mariammal Chettiyar
Production Coordinator
Arvindkumar Gupta
Cover Work
Arvindkumar Gupta
About the Authors
Dr. Michael Spreitzenbarth holds a degree of doctor of
engineering in IT security from the University of Erlangen-
Nuremberg and is a CISSP as well as a GMOB. He has been an IT
security consultant at a worldwide operating CERT for more than
three years and has worked as a freelancer in the field of mobile
phone forensics, malware analysis, and IT security consultancy for
more than six years. Since the last four years, he has been giving
talks and lectures in the fields of forensics and mobile security at
various universities and in the private sector.
First of all, I would like to thank my wife, Daniela, for her moral
support and willingness to give up on some family time while I
was writing. I also would like to thank my coauthor and
colleague, Dr. Michael Spreitzenbarth, for talking me into writing
this book and handling a great deal of the organizational
overhead of such a project. Furthermore, the great people
working on all the open source software projects that we used
and mentioned in this book deserve credit. You are the guys who
keep the IT world spinning.
About the Reviewers
Richard Marsden has over twenty years of professional experience
in software development. After starting in the fields of geophysics
and oil exploration, he has spent the last twelve years running the
Winwaed Software Technology LLC, an independent software vendor.
Winwaed specializes in geospatial tools and applications, which
include web applications, and operates the http://www.mapping-
tools.com website for tools and add-ins for geospatial products, such
as Caliper's Maptitude and Microsoft's MapPoint.
He started his career in banking and finance and then moved to the
ever growing domain of data and analytics.
Did you know that Packt offers eBook versions of every book
published, with PDF and ePub files available? You can upgrade to the
eBook version at www.PacktPub.com and as a print book customer,
you are entitled to a discount on the eBook copy. Get in touch with
us at <service@packtpub.com> for more details.
https://www2.packtpub.com/books/subscription/packtlib
Why subscribe?
Fully searchable across every book published by Packt
Copy and paste, print, and bookmark content
On demand and accessible via a web browser
Free access for Packt account
holders
If you have an account with Packt at www.PacktPub.com, you can
use this to access PacktLib today and view 9 entirely free books.
Simply use your login credentials for immediate access.
Preface
Today, information technology is a part of almost everything that
surrounds us. These are the systems that we wear and that support
us in building and running cities, companies, our personal online
shopping tours, and our friendships. These systems are attractive to
use—and abuse. Consequently, all criminal fields such as theft,
fraud, blackmailing, and so on expanded to the IT. Nowadays, this is
a multi-billion, criminal, global shadow industry.
Chapter 3, Using Python for Windows and Linux Forensics, is the first
step on your journey to understanding digital evidence. We will
provide examples to detect signs of compromise on Windows and
Linux systems. We will conclude the chapter with an example on
how to use machine learning algorithms in the forensic analysis.
Chapter 6, Using Python for Mobile Forensics, will give you an insight
on how to retrieve and analyze forensic data from mobile devices.
The examples will include analyzing Android devices as well as Apple
iOS devices.
To get the most out of this book, you should have decent skills in
Python and understand at least some inner workings of your forensic
targets. For example, some file system details.
Conventions
In this book, you will find a number of text styles that distinguish
between different kinds of information. Here are some examples of
these styles and an explanation of their meaning.
def multi_hash(filename):
"""Calculates the md5 and sha256 hashes
of the specified file and returns a list
containing the hash sums as hex strings."""
<Event
xmlns="http://schemas.microsoft.com/win/2004/08/ev
ents/event"><System><Provider Name="Microsoft-
Windows-Security-Auditing" Guid="54849625-5478-
4994-a5ba-3e3b0328c30d"></Provider>
<EventID Qualifiers="">4724</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>
New terms and important words are shown in bold. Words that
you see on the screen, for example, in menus or dialog boxes,
appear in the text like this: "When asked to Select System Logs,
ensure that all log types are selected."
Note
Warnings or important notes appear in a box like this.
Tip
Tips and tricks appear like this.
Reader feedback
Feedback from our readers is always welcome. Let us know what
you think about this book—what you liked or disliked. Reader
feedback is important for us as it helps us develop titles that you will
really get the most out of.
If there is a topic that you have expertise in and you are interested
in either writing or contributing to a book, see our author guide at
www.packtpub.com/authors.
Customer support
Now that you are the proud owner of a Packt book, we have a
number of things to help you to get the most from your purchase.
Errata
Although we have taken every care to ensure the accuracy of our
content, mistakes do happen. If you find a mistake in one of our
books—maybe a mistake in the text or the code—we would be
grateful if you could report this to us. By doing so, you can save
other readers from frustration and help us improve subsequent
versions of this book. If you find any errata, please report them by
visiting http://www.packtpub.com/submit-errata, selecting your
book, clicking on the Errata Submission Form link, and entering
the details of your errata. Once your errata are verified, your
submission will be accepted and the errata will be uploaded to our
website or added to any list of existing errata under the Errata
section of that title.
Questions
If you have a problem with any aspect of this book, you can contact
us at <questions@packtpub.com>, and we will do our best to address
the problem.
Chapter 1. Setting Up the Lab
and Introduction to Python
ctypes
Cyber Security and Digital Forensics are two topics of increasing
importance. Digital forensics especially, is getting more and more
important, not only during law enforcement investigations, but also
in the field of incident response. During all of the previously
mentioned investigations, it's fundamental to get to know the root
cause of a security breach, malfunction of a system, or a crime.
Digital forensics plays a major role in overcoming these challenges.
In this book, we will teach you how to build your own lab and
perform profound digital forensic investigations, which originate from
a large range of platforms and systems, with the help of Python. We
will start with common Windows and Linux desktop machines, then
move forward to cloud and virtualization platforms, and end up with
mobile phones. We will not only show you how to examine the data
at rest or in transit, but also take a deeper look at the volatile
memory.
Ubuntu
To work in a similar lab environment, we suggest you to download a
copy of the latest Ubuntu LTS Desktop Distribution from
http://www.ubuntu.com/download/desktop/, preferably the 32-bit
version. The distribution provides a simple-to-use UI and already has
the Python 2.7.6 environment installed and preconfigured.
Throughout the book, we will use Python 2.7.x and not the newer
3.x versions. Several examples and case studies in this book will rely
on the tools or libraries that are already a part of the Ubuntu
distribution. When a chapter or section of the book requires a third-
party package or library, we will provide the additional information
on how to install it in the virtualenv (the setup of this environment
will be explained in the next section) or on Ubuntu in general.
To write your first Python script, you can use a simple editor such as
vi or a powerful but cluttered IDE such as eclipse. As a really
powerful alternative, we would suggest you to use atom, a very
clean but highly customizable editor that can be freely downloaded
from https://atom.io/.
Python virtual environment
(virtualenv)
According to the official Python documentation, Virtual Environment
is a tool to keep the dependencies required by different projects in
separate places by creating virtual Python environments for them. It
solves the "Project X depends on version 1.x, but Project Y needs
4.x" dilemma and keeps your global site-packages directory clean
and manageable.
We will now create a folder in the users' home directory for our
virtual Python environment. This directory will contain the
executable Python files and a copy of the pip library, which can be
used to install other packages in the environment. The name of the
virtual environment (in our case, it is called labenv) can be of your
choice. Our virtual lab environment can be created by executing the
following command:
Now, you can see that the command prompt starts with the name of
the virtual environment that we activated. From now on, any
package that you install using pip will be placed in the labenv
folder, isolated from the global Python installation in the underlying
Ubuntu.
Well, Mr. Mattson, what have you to say for yourself? Is not I.
D'Israeli the most impudent thief since the days of Prometheus?
MARTIN'S GAZETTEER.
We ought to have noticed this book sooner. Mr. Martin deserves well
of the country for having laid the foundation, amidst numerous
obstacles, of a work of great utility and importance. In his preface, he
disavows all pretension to literary attainment, and claims only the
merit of enterprise and perseverance in the execution of his design.
He is entitled to all the rewards of a bold pioneer, struggling with
pecuniary difficulties, and, we might add, with public indifference, in
amassing a large amount of valuable information—interesting to
almost every man in the Commonwealth. It is one of the evils
attendant upon a high state of political excitement in any country,
that what is really and substantially good, is forgotten or neglected.
The resources of our great Commonwealth are immense, and if we
could once get the public mind into a condition favorable to their full
development, the most important consequences might be expected
to follow. Societies and associations for collecting information in the
various departments of moral and physical science, have abounded
in most countries having the least pretension to civilization; and even
in some of the States of our confederacy, it is known that an
enlightened spirit of inquiry exists on the same subject. Our own
state indeed, boastful as it is of its early history, the renown of some
of its sons, and its abundant natural advantages, has nevertheless,
we are pained to admit, manifested too little of that public spirit which
has animated other communities. Of late, indeed, some signs have
been exhibited of a more liberal and resolute course of action, and
we are not without hope that these efforts will be crowned by highly
useful and practical results.
ROSE-HILL.
"But the 'good' of Marshall is not interred with his bones. It lives after him, and will live
after him in all time to come. The incense of virtue which he burned upon his country's
altar, will continue to rise to heaven, and diffuse itself throughout the land for all
following generations. When our children shall read the story of his life, they will find it
one which, in its purity and beauty, cannot be surpassed by the history of any other
man of our age. And who can calculate the extent of the influence of such a character
upon the hearts and minds of this people, and even upon the future destinies of this
country, in regulating the dispositions of those who aspire and those who are called to
the high places of the nation? Who can say that it will not pervade the moral
atmosphere, so as to correct many of those evil tendencies which we now see
constantly developing themselves. We want such men as Marshall to rise up in our
midst, and shed around the chastened light of their influence. The glare of military
fame, and the glittering trappings of power, dazzle but too often to delude those who
gaze at them with admiration. But upon the mellow radiance of his virtues we can all
look with unclouded eyes—we can all dwell with unmingled satisfaction."
"Throughout the whole of his life, and down to its very close, Mr.
Marshall continued to cultivate a taste for general literature, and
especially for those departments of it, which had been the
favorite studies of his youth. He was familiar with all its light, as
well as its more recondite, productions. He read with intense
interest, as his leisure would allow, all the higher literature of
modern times; and, especially, the works of the great masters of
the art were his constant delight."—[Judge Story.]
The entire compatibility of such a love for elegant literature with "the
severe logic and closeness of thought, which belonged to" Judge
Marshall's character, is well vindicated by Judge Story's
observations, as well as by many illustrious examples. Among them
may be named William Wirt. The flowery complexion of his writings,
his evident delight in works of fancy, and the extraordinary graces of
his oratory, made the multitude believe him to be "of imagination all
compact." But he was in truth far more profoundly versed in the dry,
intricate lore of his profession, and by far more capable of thridding
its nicest subtleties, than thousands, whose whole minds have been
occupied with its "mystic, dark, discordant" tomes. We have been
told by one who knew him intimately, that there were few harder
students than Mr. Wirt: and that our informant had known him
repeatedly sit for six or seven hours at a time, intensely engaged in
examining a single question of law; and this too, at a period of his life
when the world thought him little more than a frothy declaimer, a
spouter of poetry, and an inditer of light newspaper essays. But to
return—Judge Story presents us most pleasing views of Col.
Marshall's character, derived from conversations with his more
distinguished son:
"I have often heard the Chief Justice speak of him in terms of the
deepest affection and reverence."... "Indeed, he never named his
father, without dwelling on his character with a fond and winning
enthusiasm. It was a theme, on which he broke out with
spontaneous eloquence; and in the spirit of the most persuasive
confidence, he would delight to expatiate on his virtues and talents.
'My father,' he would say with kindled feelings and emphasis, 'my
father was a far abler man than any of his sons. To him I owe the
solid foundation of all my own success in life.' Such praise from such
lips is inexpressibly precious. I know not whether it be most
honorable to the parent, or to the child. It warms, while it elevates
our admiration of both."
4 Judge Story.
About his eighteenth year, when he had commenced the study of the
Law, the lowering aspect of affairs between the Colonies and Great
Britain attracted his notice, and he devoted himself chiefly to the
acquiring of military skill, in a volunteer corps of the neighborhood. At
length news came, of the battle of Lexington. A militia company, in
which he held a commission, was ordered to assemble at a place ten
miles from his father's house. Mr. Binney says, "A kinsman and
contemporary, who was an eye witness of this scene, has thus
described it to me:—"
Times of civil trouble had now come, teeming with dangers hardly
less than those which had beset the country ten years before. The
Confederation, by which the States were united, was found too
feeble a bond of union, and a still feebler means of concurrent
action. It could resolve, legislate, and make requisitions upon the
States; but had no power to effectuate its resolutions, laws, or
requisitions. It could contract debts, but not lay taxes of any kind to
pay them. It could declare war, but not raise armies to wage it. It
could make treaties, but not so as to regulate commerce—perhaps
the most frequent and important aim of treaties. Each State had the
determining of its own scale of duties on imports; the power of
coining money, and of emitting paper-money at pleasure: conflicting
revenue-laws, therefore, and a disordered currency, made
"confusion worse confounded." The public debt, incurred by the
revolution, was unpaid. More than three hundred millions of
continental paper money were unredeemed; and having depreciated
to the value of one dollar for every hundred, had ceased to circulate.
Public credit was nearly at an end: private credit, by the frequent
violation of contracts, was at an equally low ebb: the administration
of civil justice was suspended, sometimes by the wilful delinquency
of the courts, sometimes by state-laws, restraining their proceedings.
Commerce, Agriculture, Manufactures—industry of every kind,—
were crippled. "Laws suspending the collection of debts; insolvent
laws; instalment laws; tender laws; and other expedients of a like
nature, which, every reflecting man knew would only aggravate the
evils, were familiarly adopted, or openly and boldly vindicated.
Popular leaders, as well as men of desperate fortunes, availed
themselves (as is usual on such occasions) of this agitating state of
things to inflame the public mind, and to bring into public odium
those wiser statesmen, who labored to support the public faith, and
to preserve the inviolability of private contracts." To strengthen the
arm of the general government, and invest it with larger powers over
the commerce, the money, and the foreign and mutual relations of
the States—was believed by most people to be the only remedy for
these intolerable evils. Mr. Marshall concurred with Gen.
Washington, Mr. Madison, and the majority of their countrymen, in
approving of this remedy; and as a member of the State Legislature,
advocated the call of a Convention, to revise the Articles of
Confederation. Whether they should be so altered, as to increase
materially the powers of the Federal Government—was a question
which in most of the State Legislatures elicited strenuous debates;
and no where more, than in the Legislature of Virginia. The men of
this day have little idea, how strong were the gusts of discussion at
that momentous period. "It is scarcely possible," says Judge Story,
"to conceive the zeal, and even animosity, with which the opposing
opinions were maintained." The dissolution or continuance of the
Union, was freely discussed: one party boldly advocating the former,
as necessary to prevent the destruction of State-sovereignty; the
other party pleading for UNION, as not only the sole cure for the
immeasurable ills which were then afflicting the land, but as
indispensable to the preservation of Liberty itself, in the several
States. And Union, it was alleged, could not be preserved but by a
more vigorous central government.
Mr. Marshall, not then thirty years old, shared largely in the
discussions which shook both the Legislative hall, and the popular
assemblies, of Virginia, on this great question. Mr. Madison, with
whom he served several years in the House of Delegates, fought
"side by side, and shoulder to shoulder" with him, through the
contest: and "the friendship, thus formed between them, was never
extinguished. The recollection of their co-operation at that period
served, when other measures had widely separated them from each
other, still to keep up a lively sense of each other's merits. Nothing,
indeed, could be more touching to an ingenuous mind, than to hear
from their lips, in their latter years, expressions of mutual respect
and confidence; or to witness their earnest testimony to the talents,
the virtues, and the services of each other."7
7 Judge Story.
It was in these debates, that Mr. Marshall's mind acquired the skill in
political discussion, which afterwards distinguished him, and which
would of itself have made him conspicuous as a parliamentarian,
had not that talent been overshadowed by his renown in a more
soberly illustrious, though less dazzling career. Here, too, it was, that
he conceived that deep dread of disunion, and that profound
conviction of the necessity for closer bonds between the States,
which gave the coloring to the whole texture of his opinions, upon
federal politics in after life.
The Convention was at length called; and its product, the present
Federal Constitution, was submitted for ratification to the States. In
most of them, Conventions were likewise called, to adopt or reject it.
Mr. Marshall, though the people of his county were decidedly
opposed to the new Constitution, and though he avowed on the
hustings his determination to support it, was elected to the Virginia
Convention by a considerable majority. In that body, he took an
effective, if not a leading part. Three able speeches of his, in behalf
of the Constitution, appear in Mr. Robertson's report of the Debates:
Speeches, seconding with "masculine logic, the persuasive talents of
George Nicholas, the animated flow of Governor Randolph, the
grave and sententious sagacity of Pendleton, the consummate skill
and various knowledge of Madison."8 After an earnest and powerful
struggle of 25 days, the Constitution was agreed to, by a majority of
but ten votes—89 to 79. This result is supposed to have been
promoted, by the news, received while the Convention sat, that nine
states had come to a similar decision. The accession of Virginia to
that number, already large enough to give the instrument validity
among the adopting states, ensured its complete success; and was
hailed by its friends with the liveliest joy.
8 Judge Story.
"We have lived," says he, "to see all their fears and prophecies
of evil scattered to the winds. We have witnessed the solid
growth and prosperity of the whole country, under the auspices
of the National Government, to an extent never even imagined
by its warmest friends. We have seen our agriculture pour forth
its various products, created by a generous, I had almost said, a
profuse industry. The miserable exports, scarcely amounting in
the times, of which I have been speaking, in the aggregate, to
the sum of one or two hundred thousand dollars, now almost
reach to forty9 millions a year in a single staple. We have seen
our commerce, which scarcely crept along our noiseless docks,
and stood motionless and withering, while the breezes of the
ocean moaned through the crevices of our ruined wharves and
deserted warehouses, spread its white canvass in every clime;
and, laden with its rich returns, spring buoyant on the waves of
the home ports; and cloud the very shores with forests of masts,
over which the stars and stripes are gallantly streaming. We
have seen our manufactures, awakening from a deathlike
lethargy, crowd every street of our towns and cities with their
busy workmen, and their busier machinery; and startling the
silence of our wide streams, and deep dells, and sequestered
valleys. We have seen our wild waterfalls, subdued by the
power of man, become the mere instruments of his will, and,
under the guidance of mechanical genius, now driving with
unerring certainty the flying shuttle, now weaving the mysterious
threads of the most delicate fabrics, and now pressing the
reluctant metals into form, as if they were but playthings in the
hands of giants. We have seen our rivers bear upon their bright
waters the swelling sails of our coasters, and the sleepless
wheels of our steamboats in endless progress. Nay, the very
tides of the ocean, in their regular ebb and flow in our ports,
seem now but heralds to announce the arrival and departure of
our uncounted navigation. We have seen all these things; and
we can scarcely believe, that there were days and nights, nay,
months and years, in which our wisest patriots and statesmen
sat down, in anxious meditation to devise the measures which
should save the country from impending ruin."
9 The exports of cotton alone, in the year ending Sept. 30th, 1834, were
$49,448,000—Reviewer.
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
textbookfull.com