How it works...

Starting with the imports, we bring in the Sleuth Kit utilities and pylnk library. We also bring in libraries for argument parsing, writing the CSV reports, and StringIO to read the Sleuth Kit objects as files:

from __future__ import print_functionfrom argparse import ArgumentParserimport csvimport StringIOfrom utility.pytskutil import TSKUtilimport pylnk

This recipe's command-line handler takes three positional arguments, EVIDENCE_FILE, IMAGE_TYPE, and CSV_REPORT, which represent the path to the evidence file, the type of evidence file, and the desired output path to the CSV report, respectively. These three arguments are passed to the main() function.

if __name__ == '__main__':    parser = argparse.ArgumentParser( description=__description__, ...

Get Python Digital Forensics Cookbook now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.