Python Forensics – Introduction

Python is a general-purpose programming language with easy-to-read code, making it easy for both professional and novice programmers to understand. Python includes many useful libraries and can be used with any stack framework. Many laboratories rely on Python to build basic predictive models and run experiments. It also helps control critical operational systems.

Python has built-in capabilities to support digital investigations and protect the integrity of evidence during investigations. In this tutorial, we will explain the basic concepts of applying Python to digital or computational forensics.

What is Computational Forensics

Computational forensics is an emerging field of study. It involves solving forensic problems with digital methods. It uses computational science to study digital evidence.

Computational forensics encompasses a broad range of topics, including the investigation of objects, substances, and processes, primarily based on pattern evidence such as toolmarks, fingerprints, shoeprints, and documents, but also includes physiological and behavioral patterns, DNA, and digital evidence from crime scenes.

The figure below shows the broad disciplines encompassed by computational forensics.

Computational forensics is performed with the help of algorithms used in signal and image processing, computer vision, and graphics. It also includes data mining, machine learning, and robotics.

Computational forensics involves various digital methods. The best solution for mitigating all digital methods in forensics is to use a general-purpose programming language like Python.