Python Forensics – Network Time Protocol The most widely used time synchronization protocol is the Network Time Protocol (NTP), which has become widely accepted as a convention. NTP uses the User Datagram Protocol (UDP), which uses the shortest possible time…
Python Forensics – Multiprocessing Support Forensic experts often find it difficult to apply digital solutions to analyze large amounts of digital evidence in common crimes. Most digital investigation tools are single-threaded; they can only execute one command at a time.…
Python Forensics – Indexing Indexing essentially provides the investigator with a complete view of the files from which they can gather potential evidence. Evidence may be contained in files, disk images, memory snapshots, or network traces. Indexing helps reduce time-consuming…
Python Forensics – Python Modules Modules in Python programs help organize code. They help group related code into a module, making it easier to understand and use. It contains arbitrarily named values that can be bound and referenced. Simply put,…
Python Forensics – Dshell and Scapy DShell Dshell is a Python-based network forensics analysis toolkit. Developed by the U.S. Army Research Laboratory, this open-source toolkit was released in 2014. Its primary focus is to facilitate forensic investigations. The toolkit consists…
Python Forensics – Basic Forensic Applications To create an application that complies with forensic guidelines, it is important to understand and follow naming conventions and patterns. Naming Rules The following table describes the rules and conventions that should be followed…
Python Forensics – Cracking an Encrypted Program In this chapter, we’ll learn how to crack text data obtained during analysis and forensics. Plain text in cryptography is normal, readable text, such as a message. On the other hand, a cipher…
Python Forensics – Python Overview Code written in Python looks very similar to code written in other traditional programming languages, such as C or Pascal. It is said that Python’s syntax borrows heavily from C, including many Python keywords that…
Python Forensics – Search Search is undoubtedly one of the pillars of forensic investigation. Today, search is only as effective as the investigator’s ability to run it through evidence. Searching for keywords in information plays a crucial role in forensics,…
Python Forensics – Indicators of Compromise Indicators of Compromise (IOCs) are defined as “pieces of forensic data, including data found in system log entries or files, that can identify potentially malicious activity on a system or network.” By monitoring IOCs,…