Python for Digital Forensics

What it is

Python is the common scripting language in forensics because it parses binary formats, talks to APIs and automates repetitive checks. Scripts do not replace validated tools. They fill gaps, process large volumes and make results repeatable.

The exam expects you to know which library fits which job and how a script should respect evidence integrity.

How it works

Python digital forensics basics

Good practice for forensic scripts:

• Open evidence read only ("rb"), and work on a copy.
• Read large files in chunks so memory is not exhausted.
• Log what was run, the script version and the input hash.
• Convert times to UTC and state the time zone.
• Test scripts against known data before relying on them.

A standard hash function reads in blocks:

import hashlib

def sha256_file(path, chunk=1024 * 1024):
    h = hashlib.sha256()
    with open(path, "rb") as f:
        for block in iter(lambda: f.read(chunk), b""):
            h.update(block)
    return h.hexdigest()

Data acquisition using Python

Libraries such as pytsk3 (bindings to The Sleuth Kit) and pyewf (bindings to libewf for E01 images) let a script read disk images and walk file systems without altering them. A script that copies a device must hash the source and the copy and compare them.

Remember the limits. A script on a live system does not provide write blocking, and imaging a physical device needs administrator rights. For formal acquisition, use a validated imager or a hardware write blocker, and use Python to verify or process the result.

Windows and Linux forensics using Python

For example, a script can count Failed password lines per source address in auth.log using re and collections.Counter. The same approach counts event ID 4625 records in an exported Security log.

Malware forensics using Python

import pefile

pe = pefile.PE("sample.exe")
for entry in pe.DIRECTORY_ENTRY_IMPORT:
    print(entry.dll.decode())

This lists imported DLLs, which hints at behavior such as networking or process injection. Run it only inside an analysis lab, and note that analysis of a file does not execute it.

Web application and cloud forensics using Python

Scripts parse web access logs with re to find injection strings, spikes by address and response codes. For cloud work, official SDKs query provider APIs: boto3 for AWS, the Azure SDK for Python and the Google Cloud client libraries.

import boto3

ct = boto3.client("cloudtrail")
resp = ct.lookup_events(
    LookupAttributes=[{"AttributeKey": "EventName", "AttributeValue": "ConsoleLogin"}],
    MaxResults=10,
)
for e in resp["Events"]:
    print(e["EventTime"], e.get("Username"))

Use read only credentials, paginate results and save the raw API responses with a hash as evidence.

Email forensics using Python

The email package parses messages and the mailbox module reads MBOX files. A script can list headers, pull out Received lines, extract attachments and hash them.

from email import policy
from email.parser import BytesParser

with open("message.eml", "rb") as f:
    msg = BytesParser(policy=policy.default).parse(f)
print(msg["From"], msg["Subject"])
for line in msg.get_all("Received", []):
    print(line)

PST files need a dedicated library or a conversion tool first.

Mobile device and IoT forensics using Python

Mobile data sits in SQLite databases and plist files, which sqlite3 and plistlib read directly. Open a copy read only:

import sqlite3

con = sqlite3.connect("file:sms_copy.db?mode=ro", uri=True)
for row in con.execute("SELECT name FROM sqlite_master WHERE type='table'"):
    print(row[0])

Convert timestamps to UTC, remembering the epoch differs: Unix 1970 (Android), 2001 (iOS and macOS Cocoa) and 1601 (Chromium browsers and Windows FILETIME). For Android, a script can call the Android Debug Bridge through subprocess. IoT work often parses exported JSON from companion apps or cloud APIs.

Multimedia forensics using Python

Images, audio and video hold metadata and can be altered. Scripts can read EXIF with Pillow (Image.open(path).getexif()), compare files by hash, compute perceptual hashes to find near duplicates, check that a file's header matches its extension, and run ffprobe through subprocess for container details. Differences in compression levels or metadata can indicate editing, but are leads, not proof.

A worked example

An examiner has 50,000 JPEG files and needs the ones taken with a particular camera between two dates. A script walks the folder, hashes each file, reads EXIF make, model and date, and writes a CSV.

Files with no EXIF are listed separately and not discarded. The examiner then checks a sample by hand in a forensic suite to validate the script.

How the exam asks about this

• "Which Python library parses Windows PE headers?" -> pefile.
• "Which module computes hashes for evidence integrity?" -> hashlib.
• "A script opens a SQLite evidence file directly for editing. What is the problem?" -> It can modify the evidence, so work on a hashed copy opened read only.