Python Forensics

Foreword

T.J. OConnor, SANS Red&Blue Team Cyber Guardian

On June 16, 2008 a user in the home of 2-year old Caylee Anthony googled for the term fool proof suffocation. A minute later, the same user logged onto the MySpace website with the profile of Casey Anthony. Tragically within months, the police found the decomposed remains of the young girl. Prosecutors charged Casey Anthony with first-degree murder and subsequently tried her 3 years later. The trial lasted 6 months and contained over 400 pieces of unique evidence. Sadly, the details of the computer search never made it to trial. The prosecutor’s computer forensic examiner employed a tool to retrieve the browser history results. In use of that tool, the examiner only searched the Internet ...