Chet Hosmer, "Python Forensics: A Workbench for Inventing and Sharing Digital Forensic Technology", Syngress, 2014

Introduction

Welcome, avid readers and Python enthusiasts alike, to my newest review. This time, we'll be delving into an innovative, investigative, and impactful book by Chet Hosmer, titled "Python Forensics: A Workbench for Inventing and Sharing Digital Forensic Technology". This book, published by Syngress in 2014, walks us through the fascinating crossroads of Python programming and digital forensics.

In an era where digital evidence has become an integral part of many investigations, be it criminal or corporate, the need for effective, versatile, and efficient tools has never been greater. Hosmer, in this ground-breaking book, offers a solution, and not just any solution, but one that empowers the reader to create their own unique tools using the widely accessible and powerful language of Python. If you're intrigued by digital forensics, cybersecurity, or Python programming, you're in for a real treat with this book.

Summary of the Book

• Chapter 1: Why Python Forensics?

  The introductory chapter establishes the need and benefits of using Python in digital forensics. It elucidates Python's advantages such as its simplicity, versatility, and wide-ranging libraries that make it a powerful tool for digital forensic investigation.

• Chapter 2: Setting up a Python Forensics Environment

  This chapter serves as a practical guide, leading readers through the setup of their Python forensics environment. Hosmer provides necessary guidance for installing, configuring, and getting familiar with Python to ensure the proper foundation for the upcoming forensic projects.

• Chapter 3: Our First Python Forensics App

  Here, Hosmer walks readers through creating their first Python forensics application. It's a hands-on chapter that familiarizes the reader with the process of coding forensic tools and helps them start their journey in digital forensics with Python.

• Chapter 4: Forensic Searching and Indexing Using Python

  In this chapter, readers are introduced to the concept of forensic searching and indexing using Python. Hosmer illustrates how Python can be utilized to search and index digital data effectively, a crucial skill in digital forensics.

• Chapter 5: Forensic Evidence Extraction JPEG and TIFF

  This chapter delves into the extraction of forensic evidence from common image formats such as JPEG and TIFF. Hosmer provides techniques and Python code samples to guide readers on how to handle and extract data from these formats.

• Chapter 6: Forensic Time

  In this chapter, Hosmer explains the significance of time in digital forensics and how Python can assist in the analysis and interpretation of time-related data in forensic investigations.

• Chapter 7: Using Natural Language Tools in Forensics

  Hosmer introduces the usage of natural language tools in forensics in this chapter. He details how Python can analyze and process natural language data, an increasingly significant component in many digital investigations.

• Chapter 8: Network Forensics Part I

  The first part of a two-chapter series on network forensics, this chapter lays the groundwork, teaching readers how to use Python for network data capture, analysis, and forensic investigation.

• Chapter 9: Network Forensics Part II

  In the continuation of the network forensics series, Hosmer delves deeper into advanced topics, providing readers with more Python code and techniques to deal with complex network forensics scenarios.

• Chapter 10: Multiprocessing for Forensics

  This chapter focuses on the importance and utilization of multiprocessing in digital forensics with Python, an essential topic in the age of multicore processors and complex digital investigations.

• Chapter 11: Rainbow in the Cloud

  Hosmer addresses the growing importance of cloud services in today's digital world, discussing how Python can be used for cloud forensic investigations and evidence extraction.

• Chapter 12: Looking Ahead

  In the final chapter, Hosmer reflects on the future of Python in digital forensics. He encourages readers to continue learning and experimenting, and to contribute to the development of new tools and solutions in Python forensics.

My Review Comments

The conundrum often faced by forensic investigators is the lack of an appropriate tool to access existing data. This commonly encountered roadblock can lead to substantial frustration. However, Python, a high-level programming language equipped with a plethora of modules and libraries, provides the capability to devise bespoke forensic tools. These resources empower us to craft tailored solutions for distinct problems.

Chet Hosmer's insightful book introduces a taxonomy of Python libraries conducive for forensic analysis. He subsequently demonstrates how to construct custom tools using Python to resolve specific issues. For instance, readers are guided through utilizing Python to traverse the file system, calculate hash values, extract data from image files, and conduct analysis via natural language processing tools. The book also sheds light on utilizing Python for password cracking. Overall, Hosmer provides an encompassing guide to leveraging Python for forensic analysis.

However, one drawback is that the book is based on the now-deprecated Python 2.7.5 library, which is not concurrent with the latest Python version. Python 2.7 has been phased out and its usage is no longer advocated. Therefore, readers are recommended to adapt the principles and concepts outlined in the book to Python 3.

In 2019, Hosmer released a sequel entitled "PowerShell and Python Together: Targeting Digital Investigations", which furnishes updated information on digital forensics, incorporating PowerShell scripts. A review of this subsequent work is on my agenda, so stay tuned.