We import the argparse, datetime, os, and struct built-in libraries to assist with running the script and interpreting the binary data within these files. We also bring in our Sleuth Kit utilities for handling the evidence files, reading the content, and iterating through folders and files. Lastly, we import the unicodecsv library to assist with writing the CSV report:
from __future__ import print_functionfrom argparse import ArgumentParserimport datetimeimport osimport structfrom utility.pytskutil import TSKUtilimport unicodecsv as csv
This recipe's command-line handler takes three positional arguments, EVIDENCE_FILE, IMAGE_TYPE, and CSV_REPORT, which represent the path to the evidence file, the type of evidence file, and ...
