What do you get with eBook?

Instant access to your Digital eBook purchase

Download this book in EPUB and PDF formats

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

Key benefits

Learn to perform forensic analysis and investigations with the help of Python, and gain an advanced understanding of the various Python libraries and frameworks

Analyze Python scripts to extract metadata and investigate forensic artifacts

The writers, Dr. Michael Spreitzenbarth and Dr. Johann Uhrmann, have used their experience to craft this hands-on guide to using Python for forensic analysis and investigations

Description

Digital forensic analysis is the process of examining and extracting data digitally and examining it. Python has the combination of power, expressiveness, and ease of use that makes it an essential complementary tool to the traditional, off-the-shelf digital forensic tools. This book will teach you how to perform forensic analysis and investigations by exploring the capabilities of various Python libraries. The book starts by explaining the building blocks of the Python programming language, especially ctypes in-depth, along with how to automate typical tasks in file system analysis, common correlation tasks to discover anomalies, as well as templates for investigations. Next, we’ll show you cryptographic algorithms that can be used during forensic investigations to check for known files or to compare suspicious files with online services such as VirusTotal or Mobile-Sandbox. Moving on, you’ll learn how to sniff on the network, generate and analyze network flows, and perform log correlation with the help of Python scripts and tools. You’ll get to know about the concepts of virtualization and how virtualization influences IT forensics, and you’ll discover how to perform forensic analysis of a jailbroken/rooted mobile device that is based on iOS or Android. Finally, the book teaches you how to analyze volatile memory and search for known malware samples based on YARA rules.

What you will learn

Explore the forensic analysis of different platforms such as Windows, Android, and vSphere

Semi-automatically reconstruct major parts of the system activity and time-line

Leverage Python ctypes for protocol decoding

Examine artifacts from mobile, Skype, and browsers

Discover how to utilize Python to improve the focus of your analysis

Investigate in volatile memory with the help of volatility on the Android and Linux platforms

What do you get with eBook?

Instant access to your Digital eBook purchase

Download this book in EPUB and PDF formats

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

Frequently bought together

$54.99

Learning Penetration Testing with Python

$54.99

$44.99

Total $ 154.97

FAQs

How do I buy and download an eBook?

Where there is an eBook version of a title available, you can buy it from the book details for that title. Add either the standalone eBook or the eBook and print book bundle to your shopping cart. Your eBook will show in your cart as a product on its own. After completing checkout and payment in the normal way, you will receive your receipt on the screen containing a link to a personalised PDF download file. This link will remain active for 30 days. You can download backup copies of the file by logging in to your account at any time.

If you already have Adobe reader installed, then clicking on the link will download and open the PDF file directly. If you don't, then save the PDF file on your machine and download the Reader to view it.

Please Note: Packt eBooks are non-returnable and non-refundable.

Packt eBook and Licensing When you buy an eBook from Packt Publishing, completing your purchase means you accept the terms of our licence agreement. Please read the full text of the agreement. In it we have tried to balance the need for the ebook to be usable for you the reader with our needs to protect the rights of us as Publishers and of our authors. In summary, the agreement says:

You may make copies of your eBook for your own use onto any machine
You may not pass copies of the eBook on to anyone else

How can I make a purchase on your website?

If you want to purchase a video course, eBook or Bundle (Print+eBook) please follow below steps:

Register on our website using your email address and the password.
Search for the title by name or ISBN using the search option.
Select the title you want to purchase.
Choose the format you wish to purchase the title in; if you order the Print Book, you get a free eBook copy of the same title.
Proceed with the checkout process (payment to be made using Credit Card, Debit Cart, or PayPal)

Where can I access support around an eBook?

If you experience a problem with using or installing Adobe Reader, the contact Adobe directly.
To view the errata for the book, see www.packtpub.com/support and view the pages for the title you have.
To view your account details or to download a new copy of the book go to www.packtpub.com/account
To contact us directly if a problem is not resolved, use www.packtpub.com/contact-us

What eBook formats do Packt support?

Our eBooks are currently available in a variety of formats such as PDF and ePubs. In the future, this may well change with trends and development in technology, but please note that our PDFs are not Adobe eBook Reader format, which has greater restrictions on security.

You will need to use Adobe Reader v9 or later in order to read Packt's PDF eBooks.

What are the benefits of eBooks?

You can get the information you need immediately
You can easily take them with you on a laptop
You can download them an unlimited number of times
You can print them out
They are copy-paste enabled
They are searchable
There is no password protection
They are lower price than print
They save resources and space

What is an eBook?

Packt eBooks are a complete electronic version of the print edition, available in PDF and ePub formats. Every piece of content down to the page numbering is the same. Because we save the costs of printing and shipping the book to you, we are able to offer eBooks at a lower cost than print editions.

When you have purchased an eBook, simply login to your account and click on the link in Your Download Area. We recommend you saving the file to your hard drive before opening it.

For optimal viewing of our eBooks, we recommend you download and install the free Adobe Reader version 9.

Filter reviews by

All

Amazon verified reviews

Yves Vandermeer Dec 14, 2015

I enjoyed to link the topics covered using fully python scripting oriented approach developed in this book.However, you already need to have experience in computer forensics and understand main concepts to be able to implement provided methods. Python learning curve is outstanding fast and most of the readers will be able to address common forensics, including mobile forensics cases by only applying provided scripts and referenced libraries.As for all python books, tutorials and available code, the reader will have to, when feeling confortable with provided code, adapt the code to his own needs. Now that The Sleuthkit provides python modules, and with help of the covered C-types, forensics practitioners will have a real added value toolset to solve ad-hoc challenges.

Amazon Verified review

Denver Water - Dawson Mar 04, 2016

Wonderful published book. Great vendor!!

ruben Dec 26, 2015

The book starts by explaining the building blocks of the Python programming language, especially ctypes in-depth, along with how to automate typical tasks in file system analysis, common correlation tasks to discover anomalies, as well as templates for investigations. Next, we’ll show you cryptographic algorithms that can be used during forensic investigations to check for known files or to compare suspicious files with online services such as VirusTotal or Mobile-Sandbox.I have seen this book very interesting, and never seens it before, with this title helprs to comprenhen the main thing this Python Forensics.We can develop many things with this kind of information that I can have with this book. in may area I can apply these all kind of topics in networking areas.Ruben.

SuJo Dec 25, 2015

This book covers a lot of various topics when it comes to forensics, most importantly it covers mobile forensics which is something that is going to increase over time as phones become more robust. I'm very happy with the purchase and right now packt has a $5 book sale on all of their titles which makes it a no brainier, so head over to their main site for your purchase if you're buying this book right now. My favorite part about the book was sniffing network traffic, and I felt the YARA rules were covered quite well.While I agree with other reviews that you'll not master everything related to Python Forensics; however you will have a solid understanding and foundation to build upon.

Perry Nally Dec 27, 2015

If you need to know details about processes and how to extract data from hard drives or mobile devices this is the book for you. Though the Android tutorial uses Android 4.4.4 you can still use the walk through using the latest version. This is a useful book with a lot of great information and python scripts. He also tells you how to setup you environment in order to perform the data acquisitions and analysis to obtain sensitive data. Everyone dealing in digital forensics should read this book and have it as a reference manual. Great job!

Mastering Python Forensics: Master the art of digital forensics and analysis with Python

What do you get with eBook?