The Sleuth Kit, and its Python bindings pytsk3, is perhaps the most well-known Python forensic library. This library offers rich support for accessing and manipulating filesystems. And with the help of supporting libraries, such as pyewf, they can be used to work with common forensic containers such as EnCase's popular E01 format. Without these libraries (and many others), we would be inherently more limited by what can be accomplished with Python in forensics. Due to its lofty goal as an all-in-one filesystem analysis tool, pytsk3 is perhaps the most complicated library we will work with in this book.
For this reason, we have dedicated a number of recipes exploring the fundamentals of this library. Up to this point, recipes have been mainly focused on loose file support. That convention ends here. We will routinely use this library going forward to interact...
