Probably within the first few hours of starting your career in cyber security, you were already hunched over a screen, feverishly scanning a spreadsheet for clues. This sounds familiar because it is true and part of the daily process for most investigations. Spreadsheets are the bread and butter of cyber security. Within them are details of various processes and specific information extracted from valuable artifacts. In this cookbook, we will frequently output parsed artifact data into a spreadsheet due to its portability and ease of use. However, considering that at one time or another every cyber security professional has created a technical report for a nontechnical audience, a spreadsheet may not be the best option.

Why create reports at all? I think I've heard that muttered by stressed examiners before. Today, everything is built on information interchange...

Recipe Difficulty: Easy

Python Version: 2.7 or 3.5

Operating System: Any

HTML can be an effective medium for a report. There are a great number of snazzy templates out there that can make even technical reports look appealing. That's the first step towards hooking the audience. Or, at the very least, a preventative measure to forestall the audience from instantly nodding off. This recipe uses one such template and some test data to create a visually compelling example of acquisition details. We really have our work cut out for us here.

This recipe introduces HTML templating with the jinja2 module. The jinja2 library is a very powerful tool and has a number of different documented features...

Recipe Difficulty: Medium

Python Version: 2.7 or 3.5

Operating System: Any

Most imaging utilities create audit logs recording the details of the acquisition media and other available metadata. Admit it; unless something goes horribly wrong, these logs are mostly untouched if the evidence verifies. Let's change that and leverage the newly created HTML dashboard from the previous recipe and make better use of this acquisition data.

All libraries used in this script are present in Python's standard library or functions imported from the prior script.

Recipe Difficulty: Easy

Python Version: 2.7 or 3.5

Operating System: Any

Everyone has reviewed data in a CSV spreadsheet at some point. They are pervasive and a common output format for most applications. Writing CSVs with Python is one of the easiest methods to create a report of processed data. In this recipe, we will demonstrate how you can use the csv and unicodecsv libraries to create quick reports with Python.

Part of this recipe uses the unicodecsv module. This module replaces the built-in Python 2 csv module and adds Unicode support. Python 3's csv module does not have this limitation and can be used without the support of any additional library. All other libraries used in this...

Recipe Difficulty: Easy

Python Version: 2.7 or 3.5

Operating System: Any

Let's take it one step further from the previous recipe with Excel. Excel is a very robust spreadsheet application and we can do a lot with it. We will use Excel to create a table and plot graphs of the data.

There are a number of different Python libraries with varying support for Excel and its many features. In this recipe, we use the xlsxwriter module to create a table and graph of the data. This module can be used for much more than that. This module can be installed by pip using the following command:

pip install xlsxwriter==0.9.9

Recipe Difficulty: Easy

Python Version: 2.7 or 3.5

Operating System: Any

Keeping detailed investigative notes is a key to any investigation. Without this, it can be difficult to put all of the pieces together or accurately recall findings. Sometimes, it can be helpful to have a screenshot or a series of them to remind you of the various steps you took during your review.

In order to create a recipe with cross-platform support, we have elected to use the pyscreenshot module. This module relies on a few dependencies, specifically the Python Imaging Library (PIL), and one or more backends. The backend used here is the WX GUI library. All three of these modules can be installed with pip:

pip...