Getting Started with Python Digital Forensics
Getting Started with Digital Forensics with Python
In the previous chapter, we learned the basics of digital forensics, its advantages, and limitations. This chapter will familiarize you with Python, the essential tool we will use in this digital forensics investigation.
Why Python for Digital Forensics
Python is a popular programming language used as a tool for network security, penetration testing, and digital forensics investigations. When you choose Python as your digital forensics tool, you don’t need any other third-party software to complete your tasks.
The following are some unique features of the Python programming language that make it well-suited for digital forensics projects.
- Simple Syntax – Compared to other languages, Python’s syntax is simple, making it easier to learn and get involved in digital forensics.
-
Comprehensive Built-in Modules – Python’s comprehensive built-in modules are a great aid in conducting complete digital forensics investigations.
-
Help and Support – As an open-source programming language, Python enjoys excellent support from the developer and user communities.
Features of Python
Python is a high-level, interpreted, interactive, and object-oriented scripting language with the following features.
- Easy to Learn – Python is a developer-friendly and easy-to-learn language due to its keyword-less nature and minimal structure.
-
Expressive and Easy to Read – Python is expressive in nature, making its code easier to understand and read.
-
Cross-Platform Compatibility – Python is a cross-platform compatible language, meaning it can run effectively on various platforms, such as UNIX, Windows, and Macintosh.
-
Interactive Mode Programming – We can interactively test and debug our code because Python supports interactive mode programming.
-
Provide Various Modules and Functions – Python has a large standard library, allowing us to use a rich set of modules and functions for our scripts.
-
Support Dynamic Type Checking – Python supports dynamic type checking and provides very advanced dynamic data types.
-
GUI Programming – Python supports GUI programming for developing graphical user interfaces.
-
Integration with Other Programming Languages – Python can be easily integrated with other programming languages such as C, C++, and Java.
Installing Python
Python distributions are available for various platforms, such as Windows, UNIX, Linux, and Mac. We simply need to download the binary code for our platform. If binary code for any platform is unavailable, we must have a C compiler so we can compile the source code manually.
This section will familiarize you with installing Python on various platforms.
Python Installation on Unix and Linux
You can follow the steps below to install Python on a Unix/Linux machine.
Step 1 – Open a web browser. Type www.python.org/downloads/
Step 2 — Download the zipped source code for Unix/Linux.
Step 3 — Unzip the downloaded zip file.
Step 4 — If you want to customize some options, you can edit the modules/configuration file.
Step 5 — Complete the installation using the following command:
run ./configure script
make
make install
Once you have successfully completed the above steps, Python will be installed in its standard location, /usr/local/bin, and its libraries will be installed in /usr/local/lib/pythonXX, where XX is the Python version.
Python Installation on Windows
We can follow these simple steps to install Python on a Windows machine.
Step 1 – Open a web browser. Type and enter www.python.org/downloads/
Step 2 – Download the Windows installer python-XYZ.msi file, where XYZ is the version you want to install.
Step 3 – Now run the MSI file and save the installer file to your local machine.
Step 4 – Run the downloaded file. The Python installation wizard will appear.
Python Installation on Macintosh
To install Python 3 on Mac OS X, we must use a package installer called Homebrew.
You can install Homebrew using the following command if it’s not already installed on your system:
$ ruby -e "$(curl -fsSL
https://raw.githubusercontent.com/Homebrew/install/master/install)"
If you need to update your package manager, you can do so with the help of the following command.
$ brew update
Now, install Python 3 on your system using the following command:
$ brew install python3
Setting PATH
We need to set the path for Python installation, which is different on UNIX, Windows, or Mac platforms.
Path Settings on Unix/Linux
On Unix/Linux, you can set the path using the following options: −
- If using the csh shell – Type setenv PATH “$PATH:/usr/local/bin/python” and press Enter.
-
If using the bash shell (Linux) – Type export ATH=”$PATH:/usr/local/bin/python” and press Enter.
-
If using the sh or ksh shell – Type PATH=”$PATH:/usr/local/bin/python” and press Enter.
Path Settings on Windows
In the command prompt, enter the path %path%;C:Python and press Enter.
Running Python
You can start the Python interpreter in any of the following three ways:
Method 1: Using the Interactive Interpreter
A system that provides a command-line interpreter or shell can easily be used to start Python. For example, Unix, DOS, etc. You can start coding in the interactive interpreter by following the steps below:
Step 1 – Type python in the command line.
Step 2 – Start coding immediately in the interactive interpreter using the command shown below.
$python # Unix/Linux
or
python% # Unix/Linux
or
C:> python # Windows/DOS
Method 2: Using a Script from the Command Line
We can also execute Python scripts from the command line by calling the interpreter from our application. You can use the following command.
$python script.py # Unix/Linux
or
python% script.py # Unix/Linux
or
C:> python script.py # Windows/DOS
Method 3: Integrated Development Environment
If a system has a GUI application that supports Python, Python can be run from that GUI environment. Here are some IDEs available for various platforms:
-
Unix IDE – UNIX has the IDLE IDE for Python.
-
Windows IDE – Windows has PythonWin, the first Windows-based interface and graphical interface for Python.
-
Macintosh IDE – Macintosh has the IDLE IDE, which can be downloaded as a MacBinary or BinHex’d file from the main website.