Mastering Python Forensics

Mastering Python Forensics

by Dr. Michael Spreitzenbarth, Dr. Johann Uhrmann
Released October 2015
Publisher(s): Packt Publishing
ISBN: 9781783988044

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Master the art of digital forensics and analysis with Python

About This Book

  • Learn to perform forensic analysis and investigations with the help of Python, and gain an advanced understanding of the various Python libraries and frameworks
  • Analyze Python scripts to extract metadata and investigate forensic artifacts
  • The writers, Dr. Michael Spreitzenbarth and Dr. Johann Uhrmann, have used their experience to craft this hands-on guide to using Python for forensic analysis and investigations

Who This Book Is For

If you are a network security professional or forensics analyst who wants to gain a deeper understanding of performing forensic analysis with Python, then this book is for you. Some Python experience would be helpful.

What You Will Learn

  • Explore the forensic analysis of different platforms such as Windows, Android, and vSphere
  • Semi-automatically reconstruct major parts of the system activity and time-line
  • Leverage Python ctypes for protocol decoding
  • Examine artifacts from mobile, Skype, and browsers
  • Discover how to utilize Python to improve the focus of your analysis
  • Investigate in volatile memory with the help of volatility on the Android and Linux platforms

In Detail

Digital forensic analysis is the process of examining and extracting data digitally and examining it. Python has the combination of power, expressiveness, and ease of use that makes it an essential complementary tool to the traditional, off-the-shelf digital forensic tools.

This book will teach you how to perform forensic analysis and investigations by exploring the capabilities of various Python libraries.

The book starts by explaining the building blocks of the Python programming language, especially ctypes in-depth, along with how to automate typical tasks in file system analysis, common correlation tasks to discover anomalies, as well as templates for investigations. Next, we'll show you cryptographic algorithms that can be used during forensic investigations to check for known files or to compare suspicious files with online services such as VirusTotal or Mobile-Sandbox.

Moving on, you'll learn how to sniff on the network, generate and analyze network flows, and perform log correlation with the help of Python scripts and tools. You'll get to know about the concepts of virtualization and how virtualization influences IT forensics, and you'll discover how to perform forensic analysis of a jailbroken/rooted mobile device that is based on iOS or Android.

Finally, the book teaches you how to analyze volatile memory and search for known malware samples based on YARA rules.

Style and approach

This easy-to-follow guide will demonstrate forensic analysis techniques by showing you how to solve real-word-scenarios step by step.

Table of contents

  1. Mastering Python Forensics
    1. Table of Contents
    2. Mastering Python Forensics
    3. Credits
    4. About the Authors
    5. About the Reviewers
    6. www.PacktPub.com
      1. Support files, eBooks, discount offers, and more
        1. Why subscribe?
        2. Free access for Packt account holders
    7. Preface
      1. What this book covers
      2. What you need for this book
      3. Who this book is for
      4. Conventions
      5. Reader feedback
      6. Customer support
        1. Downloading the example code
        2. Errata
        3. Piracy
        4. Questions
    8. 1. Setting Up the Lab and Introduction to Python ctypes
      1. Setting up the Lab
        1. Ubuntu
        2. Python virtual environment (virtualenv)
      2. Introduction to Python ctypes
        1. Working with Dynamic Link Libraries
        2. C data types
          1. Defining Unions and Structures
      3. Summary
    9. 2. Forensic Algorithms
      1. Algorithms
        1. MD5
        2. SHA256
        3. SSDEEP
      2. Supporting the chain of custody
        1. Creating hash sums of full disk images
        2. Creating hash sums of directory trees
      3. Real-world scenarios
        1. Mobile Malware
        2. NSRLquery
          1. Downloading and installing nsrlsvr
          2. Writing a client for nsrlsvr in Python
      4. Summary
    10. 3. Using Python for Windows and Linux Forensics
      1. Analyzing the Windows Event Log
        1. The Windows Event Log
        2. Interesting Events
        3. Parsing the Event Log for IOC
          1. The python-evtx parser
          2. The plaso and log2timeline tools
      2. Analyzing the Windows Registry
        1. Windows Registry Structure
        2. Parsing the Registry for IOC
          1. Connected USB Devices
          2. User histories
          3. Startup programs
          4. System Information
          5. Shim Cache Parser
      3. Implementing Linux specific checks
        1. Checking the integrity of local user credentials
        2. Analyzing file meta information
          1. Understanding inode
          2. Reading basic file metadata with Python
          3. Evaluating POSIX ACLs with Python
          4. Reading file capabilities with Python
        3. Clustering file information
          1. Creating histograms
          2. Advanced histogram techniques
      4. Summary
    11. 4. Using Python for Network Forensics
      1. Using Dshell during an investigation
      2. Using Scapy during an investigation
      3. Summary
    12. 5. Using Python for Virtualization Forensics
      1. Considering virtualization as a new attack surface
        1. Virtualization as an additional layer of abstraction
        2. Creation of rogue machines
        3. Cloning of systems
      2. Searching for misuse of virtual resources
        1. Detecting rogue network interfaces
        2. Detecting direct hardware access
      3. Using virtualization as a source of evidence
        1. Creating forensic copies of RAM content
        2. Using snapshots as disk images
        3. Capturing network traffic
      4. Summary
    13. 6. Using Python for Mobile Forensics
      1. The investigative model for smartphones
      2. Android
        1. Manual Examination
        2. Automated Examination with the help of ADEL
          1. Idea behind the system
          2. Implementation and system workflow
          3. Working with ADEL
        3. Movement profiles
      3. Apple iOS
        1. Getting the Keychain from a jailbroken iDevice
        2. Manual Examination with libimobiledevice
      4. Summary
    14. 7. Using Python for Memory Forensics
      1. Understanding Volatility basics
      2. Using Volatility on Android
        1. LiME and the recovery image
        2. Volatility for Android
        3. Reconstructing data for Android
          1. Call history
          2. Keyboard cache
      3. Using Volatility on Linux
        1. Memory acquisition
        2. Volatility for Linux
        3. Reconstructing data for Linux
          1. Analyzing processes and modules
          2. Analyzing networking information
          3. Malware hunting with the help of YARA
      4. Summary
      5. Where to go from here
    15. Index

Product information

  • Title: Mastering Python Forensics
  • Author(s): Dr. Michael Spreitzenbarth, Dr. Johann Uhrmann
  • Release date: October 2015
  • Publisher(s): Packt Publishing
  • ISBN: 9781783988044