![]()
Mastering Python Forensics
![]()
Table of Contents
Mastering Python Forensics
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Support files, eBooks, discount offers, and more
Why subscribe?
Free access for Packt account holders
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Downloading the example code
Errata
Piracy
Questions
1. Setting Up the Lab and Introduction to Python ctypes
Setting up the Lab
Ubuntu
Python virtual environment (virtualenv)
Introduction to Python ctypes
Working with Dynamic Link Libraries
C data types
Defining Unions and Structures
Summary
2. Forensic Algorithms
Algorithms
MD5
SHA256
SSDEEP
Supporting the chain of custody
Creating hash sums of full disk images
Creating hash sums of directory trees
Real-world scenarios
Mobile Malware
NSRLquery
Downloading and installing nsrlsvr
Writing a client for nsrlsvr in Python
Summary
3. Using Python for Windows and Linux Forensics
Analyzing the Windows Event Log
The Windows Event Log
Interesting Events
Parsing the Event Log for IOC
The python-evtx parser
The plaso and log2timeline tools
Analyzing the Windows Registry
Windows Registry Structure
Parsing the Registry for IOC
Connected USB Devices
User histories
Startup programs
System Information
Shim Cache Parser
Implementing Linux specific checks
Checking the integrity of local user credentials
Analyzing file meta information
Understanding inode
Reading basic file metadata with Python
Evaluating POSIX ACLs with Python
Reading file capabilities with Python
Clustering file information
Creating histograms
Advanced histogram techniques
Summary
4. Using Python for Network Forensics
Using Dshell during an investigation
Using Scapy during an investigation
Summary
5. Using Python for Virtualization Forensics
Considering virtualization as a new attack surface
Virtualization as an additional layer of abstraction
Creation of rogue machines
Cloning of systems
Searching for misuse of virtual resources
Detecting rogue network interfaces
Detecting direct hardware access
Using virtualization as a source of evidence
Creating forensic copies of RAM content
Using snapshots as disk images
Capturing network traffic
Summary
6. Using Python for Mobile Forensics
The investigative model for smartphones
Android
Manual Examination
Automated Examination with the help of ADEL
Idea behind the system
Implementation and system workflow
Working with ADEL
Movement profiles
Apple iOS
Getting the Keychain from a jailbroken iDevice
Manual Examination with libimobiledevice
Summary
7. Using Python for Memory Forensics
Understanding Volatility basics
Using Volatility on Android
LiME and the recovery image
Volatility for Android
Reconstructing data for Android
Call history
Keyboard cache
Using Volatility on Linux
Memory acquisition
Volatility for Linux
Reconstructing data for Linux
Analyzing processes and modules
Analyzing networking information
Malware hunting with the help of YARA
Summary
Where to go from here
Index
![]()
Mastering Python Forensics
Copyright © 2015 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.
First published: October 2015
Production reference: 1261015
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham B3 2PB, UK.
ISBN 978-1-78398-804-4
www.packtpub.com
![]()
Authors
Dr. Michael Spreitzenbarth
Dr. Johann Uhrmann
Reviewers
Richard Marsden
Puneet Narula
Yves Vandermeer
Commissioning Editor
Kartikey Pandey
Acquisition Editor
Sonali Vernekar
Content Development Editor
Shweta Pant
Technical Editor
Pranil Pathare
Copy Editor
Vibha Shukla
Project Coordinator
Shipra Chawhan
Proofreader
Safis Editing
Indexer
Mariammal Chettiyar
Production Coordinator
Arvindkumar Gupta
Cover Work
Arvindkumar Gupta
![]()
Dr. Michael Spreitzenbarth holds a degree of doctor of engineering in IT security from the University of Erlangen-Nuremberg and is a CISSP as well as a GMOB. He has been an IT security consultant at a worldwide operating CERT for more than three years and has worked as a freelancer in the field of mobile phone forensics, malware analysis, and IT security consultancy for more than six years. Since the last four years, he has been giving talks and lectures in the fields of forensics and mobile security at various universities and in the private sector.
Dr. Johann Uhrmann holds a degree in computer science from the University of Applied Sciences Landshut and a doctor of engineering from the University of the German Federal Armed Forces. He has more than ten years of experience in software development, which includes working for start-ups, institutional research, and corporate environment. Johann has several years of experience in incident handling and IT governance, focusing on Linux and Cloud environments.
![]()
Richard Marsden has over twenty years of professional experience in software development. After starting in the fields of geophysics and oil exploration, he has spent the last twelve years running the Winwaed Software Technology LLC, an independent software vendor. Winwaed specializes in geospatial tools and applications, which include web applications, and operates the http://www.mapping-tools.com website for tools and add-ins for geospatial products, such as Caliper's Maptitude and Microsoft's MapPoint.
Richard was also a technical reviewer for Python Geospatial Development, and Python Geospatial Analysis Essentials, both written by Erik Westra, Packt Publishing.
Puneet Narula is ...
