Unit 3 of Python for Cyber Security

Digital Forensics with Python

Hashing and preserving evidence, indexing a disk image, extracting hidden metadata from images and documents, reading browser artefacts from SQLite, rebuilding a timeline from MACB times, and carving files out of raw bytes.

Learning outcomes

Explain the order of volatility and why evidence is hashed before it is touched
Search and index forensic data with Python
Extract EXIF, document and browser artefacts
Order timestamps into a forensic timeline
Recover files from raw data by carving

Topics

3.1

The Digital Forensic Investigation Process

The crime scene: the one rule every script in this unit follows, do not alter the evidence, the six-stage forensic process, chain of custody, and the order of volatility pictured as a freezer full of food.

6 min

3.2

Setting Up a Python Forensic Environment

Three things a forensic workstation needs that an ordinary development machine does not, the small set of packages this unit uses, and a tiny reusable logging helper that becomes the first brick of every script's chain of custody.

5 min

Assessments

Unit Assessment

Digital Forensics with Python

20 questions30 minPass: 60%

Start exam →

Comprehensive Assessment

Digital Forensics with Python

Topics

The Digital Forensic Investigation Process

Setting Up a Python Forensic Environment

Forensic Searching and Indexing

Image Metadata: EXIF Data

Document Metadata and Browser Artefacts

MACB Times

Converting Timestamps and Building a Timeline

File Carving: Recovering Data Without a File System

Unit 3 Quick Reference, Self-Study and Lab