Mastering Python Forensics

Dr. Michael Spreitzenbarth, Dr. Johann Uhrmann

• Publisher: Packt Publishing
• Year: 2015
• eBook ISBN: 9781783988044
• Edition: 1
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

Master the art of digital forensics and analysis with Python

About This Book

• Learn to perform forensic analysis and investigations with the help of Python, and gain an advanced understanding of the various Python libraries and frameworks
• Analyze Python scripts to extract metadata and investigate forensic artifacts
• The writers, Dr. Michael Spreitzenbarth and Dr. Johann Uhrmann, have used their experience to craft this hands-on guide to using Python for forensic analysis and investigations

Who This Book Is For

If you are a network security professional or forensics analyst who wants to gain a deeper understanding of performing forensic analysis with Python, then this book is for you. Some Python experience would be helpful.

What You Will Learn

• Explore the forensic analysis of different platforms such as Windows, Android, and vSphere
• Semi-automatically reconstruct major parts of the system activity and time-line
• Leverage Python ctypes for protocol decoding
• Examine artifacts from mobile, Skype, and browsers
• Discover how to utilize Python to improve the focus of your analysis
• Investigate in volatile memory with the help of volatility on the Android and Linux platforms
  

In Detail

Digital forensic analysis is the process of examining and extracting data digitally and examining it. Python has the combination of power, expressiveness, and ease of use that makes it an essential complementary tool to the traditional, off-the-shelf digital forensic tools.

This book will teach you how to perform forensic analysis and investigations by exploring the capabilities of various Python libraries.

The book starts by explaining the building blocks of the Python programming language, especially ctypes in-depth, along with how to automate typical tasks in file system analysis, common correlation tasks to discover anomalies, as well as templates for investigations. Next, we'll show you cryptographic algorithms that can be used during forensic investigations to check for known files or to compare suspicious files with online services such as VirusTotal or Mobile-Sandbox.

Moving on, you'll learn how to sniff on the network, generate and analyze network flows, and perform log correlation with the help of Python scripts and tools. You'll get to know about the concepts of virtualization and how virtualization influences IT forensics, and you'll discover how to perform forensic analysis of a jailbroken/rooted mobile device that is based on iOS or Android.

Finally, the book teaches you how to analyze volatile memory and search for known malware samples based on YARA rules.

Style and approach

This easy-to-follow guide will demonstrate forensic analysis techniques by showing you how to solve real-word-scenarios step by step.

Mastering Python Forensics

---

Table of Contents

Mastering Python Forensics

Credits

About the Authors

About the Reviewers

www.PacktPub.com

Support files, eBooks, discount offers, and more

Why subscribe?

Free access for Packt account holders

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Errata

Piracy

Questions

1. Setting Up the Lab and Introduction to Python ctypes

Setting up the Lab

Ubuntu

Python virtual environment (virtualenv)

Introduction to Python ctypes

Working with Dynamic Link Libraries

C data types

Defining Unions and Structures

Summary

2. Forensic Algorithms

Algorithms

MD5

SHA256

SSDEEP

Supporting the chain of custody

Creating hash sums of full disk images

Creating hash sums of directory trees

Real-world scenarios

Mobile Malware

NSRLquery

Downloading and installing nsrlsvr

Writing a client for nsrlsvr in Python

Summary

3. Using Python for Windows and Linux Forensics

Analyzing the Windows Event Log

The Windows Event Log

Interesting Events

Parsing the Event Log for IOC

The python-evtx parser

The plaso and log2timeline tools

Analyzing the Windows Registry

Windows Registry Structure

Parsing the Registry for IOC

Connected USB Devices

User histories

Startup programs

System Information

Shim Cache Parser

Implementing Linux specific checks

Checking the integrity of local user credentials

Analyzing file meta information

Understanding inode

Reading basic file metadata with Python

Evaluating POSIX ACLs with Python

Reading file capabilities with Python

Clustering file information

Creating histograms

Advanced histogram techniques

Summary

4. Using Python for Network Forensics

Using Dshell during an investigation

Using Scapy during an investigation

Summary

5. Using Python for Virtualization Forensics

Considering virtualization as a new attack surface

Virtualization as an additional layer of abstraction

Creation of rogue machines

Cloning of systems

Searching for misuse of virtual resources

Detecting rogue network interfaces

Detecting direct hardware access

Using virtualization as a source of evidence

Creating forensic copies of RAM content

Using snapshots as disk images

Capturing network traffic

Summary

6. Using Python for Mobile Forensics

The investigative model for smartphones

Android

Manual Examination

Automated Examination with the help of ADEL

Idea behind the system

Implementation and system workflow

Working with ADEL

Movement profiles

Apple iOS

Getting the Keychain from a jailbroken iDevice

Manual Examination with libimobiledevice

Summary

7. Using Python for Memory Forensics

Understanding Volatility basics

Using Volatility on Android

LiME and the recovery image

Volatility for Android

Reconstructing data for Android

Call history

Keyboard cache

Using Volatility on Linux

Memory acquisition

Volatility for Linux

Reconstructing data for Linux

Analyzing processes and modules

Analyzing networking information

Malware hunting with the help of YARA

Summary

Where to go from here

Index

Mastering Python Forensics

Copyright © 2015 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: October 2015

Production reference: 1261015

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham B3 2PB, UK.

ISBN 978-1-78398-804-4

www.packtpub.com

Credits

Authors

Dr. Michael Spreitzenbarth

Dr. Johann Uhrmann

Reviewers

Richard Marsden

Puneet Narula

Yves Vandermeer

Commissioning Editor

Kartikey Pandey

Acquisition Editor

Sonali Vernekar

Content Development Editor

Shweta Pant

Technical Editor

Pranil Pathare

Copy Editor

Vibha Shukla

Project Coordinator

Shipra Chawhan

Proofreader

Safis Editing

Indexer

Mariammal Chettiyar

Production Coordinator

Arvindkumar Gupta

Cover Work

Arvindkumar Gupta

About the Authors

Dr. Michael Spreitzenbarth holds a degree of doctor of engineering in IT security from the University of Erlangen-Nuremberg and is a CISSP as well as a GMOB. He has been an IT security consultant at a worldwide operating CERT for more than three years and has worked as a freelancer in the field of mobile phone forensics, malware analysis, and IT security consultancy for more than six years. Since the last four years, he has been giving talks and lectures in the fields of forensics and mobile security at various universities and in the private sector.

I would like to thank everyone who has encouraged me while writing this book, especially my wife for her great support. I would also like to thank all the authors of the used open source tools— without your help, this book wouldn't have been possible.

Dr. Johann Uhrmann holds a degree in computer science from the University of Applied Sciences Landshut and a doctor of engineering from the University of the German Federal Armed Forces. He has more than ten years of experience in software development, which includes working for start-ups, institutional research, and corporate environment. Johann has several years of experience in incident handling and IT governance, focusing on Linux and Cloud environments.

First of all, I would like to thank my wife, Daniela, for her moral support and willingness to give up on some family time while I was writing. I also would like to thank my coauthor and colleague, Dr. Michael Spreitzenbarth, for talking me into writing this book and handling a great deal of the organizational overhead of such a project. Furthermore, the great people working on all the open source software projects that we used and mentioned in this book deserve credit. You are the guys who keep the IT world spinning.

About the Reviewers

Richard Marsden has over twenty years of professional experience in software development. After starting in the fields of geophysics and oil exploration, he has spent the last twelve years running the Winwaed Software Technology LLC, an independent software vendor. Winwaed specializes in geospatial tools and applications, which include web applications, and operates the http://www.mapping-tools.com website for tools and add-ins for geospatial products, such as Caliper's Maptitude and Microsoft's MapPoint.

Richard was also a technical reviewer for Python Geospatial Development, and Python Geospatial Analysis Essentials, both written by Erik Westra, Packt Publishing.

Puneet Narula is ...

Table of contents

• Mastering Python Forensics