Before the first line of forensic Python runs, a workstation needs a handful of things an ordinary development machine does not. None of them are complicated, but skipping any one of them weakens everything built on top.
Three things a forensic workstation needs
Work from a copy
Evidence is always worked from a copy, never the original, enforced with a hardware write-blocker when imaging physical media or simply by copying a file before touching it.
Log everything
Every script logs what it did and when, because an undocumented action is of little use as evidence.
A small, predictable toolkit
A short list of packages covers most of what this unit needs, so every machine in a team can be set up the same way.
The packages this unit uses
Most of the work in this unit comes from Python's own standard library, which needs no installation at all.
Tool in focus: hashlib and the standard library
hashlib (hashing), sqlite3 (reading browser and app databases), os (walking the file system) and datetime (timestamps) are all part of Python's standard library. They do most of the forensic work in this unit; the pip line below adds only file-type detection, image reading and PDF reading.
terminal
$ pip install python-magic pillow pypdf
Caution: python-magic on Windows
python-magic wraps a system library called libmagic, which Linux and macOS have installed already. On Windows, install python-magic-bin instead of python-magic; it bundles the library the wrapper needs. Everything else in this unit's code is identical either way.
| Package | What it is for |
|---|---|
hashlib | Computing a file's hash (standard library) |
sqlite3 | Reading browser and application databases (standard library) |
os, datetime | Walking the file system, reading and converting timestamps (standard library) |
python-magic | Identifying a file's true type from its content |
pillow | Reading image files and their EXIF metadata |
pypdf | Reading PDF files and their metadata |
A logging helper every script in this unit shares
A minimal logging helper, used by every script from here on, keeps a timestamped record, which is the first brick of the chain of custody from the last article.
forensic_log.py
# forensic_log.py: a tiny, reusable logging helper
import datetime
def log_action(logfile, message):
timestamp = datetime.datetime.now().isoformat()
with open(logfile, "a") as f:
f.write(f"{timestamp} {message}\n")
print(f"[{timestamp}] {message}")
Ten lines, and every script in this unit that touches a file calls it at least once. log_action does two things at once: it writes a permanent, timestamped line to a log file opened in append mode, the mode from Unit 1 that never erases what came before, and it prints the same line to the screen so the investigator sees progress in real time. Nothing about this function is forensic magic; it is the same with open(..., "a") pattern from Unit 1's file-handling article, pointed at a specific job.
Python concept: Why append mode, specifically
A forensic log must never lose an earlier entry, including one written moments before a crash. Mode "a" guarantees that: each call opens the file, writes one line, and closes it again, so even a script that dies partway through leaves every entry it managed to write intact. Mode "w", which overwrites on each run, would be exactly wrong here.
Try it yourself: Watch the log grow
Save forensic_log.py, then from the same folder run:
from forensic_log import log_action
log_action("test.log", "started examining evidence_copy/")
log_action("test.log", "hashed report.pdf")
Open test.log afterwards. Two lines, each with its own timestamp, in the order they happened. That file is the pattern every script in this unit builds on.
Check your understanding
Question 1: Name the three things a forensic workstation needs beyond an ordinary development machine.
Working only from copies of evidence, never the originals; logging every action a script takes, with a timestamp; and a small, predictable set of packages so every examiner's setup matches.
Question 2: Which of this unit's packages are part of Python's standard library, and which need pip?
hashlib, sqlite3, os and datetime are standard library and need no installation. python-magic, pillow and pypdf are third-party and are installed with pip (python-magic-bin on Windows).
Question 3: Why does log_action open its file in append mode rather than write mode?
Append mode guarantees that every call adds a line without erasing what came before, so even a script that fails partway through leaves a complete record up to that point. Write mode would erase the log's history on every run, which is the opposite of what a chain-of-custody record needs.
Key takeaway: Key takeaway
A forensic workstation differs from an ordinary one in three small but non-negotiable ways: copies, not originals; logged, not silent; a short, predictable toolkit. The ten-line logger built here is the thread that ties every script in this unit back to the chain of custody.