How it works...

We import a number of libraries to assist with argument parsing, creating CSV spreadsheets, hashing files, handling evidence containers and filesystems, and creating progress bars.

from __future__ import print_functionimport argparseimport csvimport hashlibimport osimport pytsk3import pyewfimport sysfrom tqdm import tqdm

This recipe's command-line handler takes three positional arguments, EVIDENCE_FILE, TYPE, and HASH_LIST, which represent the evidence file, the type of evidence file, and the newline delimited list of hashes to search for, respectively. As always, the user can also manually supply the partition type using the p switch if necessary.

if __name__ == '__main__':    parser = argparse.ArgumentParser( description=__description__, ...

Get Python Digital Forensics Cookbook now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.