The Sleuth Kit, and its Python bindings pytsk3, is perhaps the most well-known Python forensic library. This library offers rich support for accessing and manipulating filesystems. And with the help of supporting libraries, such as pyewf, they can be used to work with common forensic containers such as EnCase's popular E01 format. Without these libraries (and many others), we would be inherently more limited by what can be accomplished with Python in forensics. Due to its lofty goal as an all-in-one filesystem analysis tool, pytsk3 is perhaps the most complicated library we will work with in this book.

For this reason, we have dedicated a number of recipes exploring the fundamentals of this library. Up to this point, recipes have been mainly focused on loose file support. That convention ends here. We will routinely use this library going forward to interact with forensic evidence. Understanding how to interact with forensic containers will take your Python forensic capabilities to the next level.

In this chapter, we will learn how to install pytsk3 and pyewf, two libraries that will allow us to leverage the Sleuth Kit and E01 image support, respectively. Additionally, we will learn how to perform basic tasks, such as accessing and printing a partition table, iterating through a filesystem, exporting files by extension, and searching for known bad hashes in an evidence container. You will learn about:

• Installing and setting up pytsk3 and pyewf
• Opening forensic acquisitions such as raw and E01 files
• Extracting partition table data and E01 metadata
• Recursing through active files and creating an active file listing spreadsheet
• Exporting files from the evidence container by file extension
• Searching for known bad hashes in an evidence container