We import a number of libraries to assist with argument parsing, creating CSV spreadsheets, hashing files, handling evidence containers and filesystems, and creating progress bars.
from __future__ import print_functionimport argparseimport csvimport hashlibimport osimport pytsk3import pyewfimport sysfrom tqdm import tqdm
This recipe's command-line handler takes three positional arguments, EVIDENCE_FILE, TYPE, and HASH_LIST, which represent the evidence file, the type of evidence file, and the newline delimited list of hashes to search for, respectively. As always, the user can also manually supply the partition type using the p switch if necessary.
if __name__ == '__main__': parser = argparse.ArgumentParser( description=__description__, ...
