{"product_id":"9781783988051","title":"Mastering Python Forensics","description":"\u003cp\u003e\u003cb\u003eMaster the art of digital forensics and analysis with Python\u003c\/b\u003e\u003c\/p\u003e\u003cp\u003e\u003cb\u003eAbout This Book\u003c\/b\u003e\u003c\/p\u003e\u003cul\u003e\n\u003cli\u003eLearn to perform forensic analysis and investigations with the help of Python, and gain an advanced understanding of the various Python libraries and frameworks\u003c\/li\u003e\n\u003cli\u003eAnalyze Python scripts to extract metadata and investigate forensic artifacts\u003c\/li\u003e\n\u003cli\u003eThe writers, Dr. Michael Spreitzenbarth and Dr. Johann Uhrmann, have used their experience to craft this hands-on guide to using Python for forensic analysis and investigations\u003c\/li\u003e\n\u003c\/ul\u003e\u003cb\u003eWho This Book Is For\u003c\/b\u003e\u003cp\u003eIf you are a network security professional or forensics analyst who wants to gain a deeper understanding of performing forensic analysis with Python, then this book is for you. Some Python experience would be helpful.\u003c\/p\u003e\u003cp\u003e\u003cb\u003eWhat You Will Learn\u003c\/b\u003e\u003c\/p\u003e\u003cul\u003e\n\u003cli\u003eExplore the forensic analysis of different platforms such as Windows, Android, and vSphere\u003c\/li\u003e\n\u003cli\u003eSemi-automatically reconstruct major parts of the system activity and time-line\u003c\/li\u003e\n\u003cli\u003eLeverage Python ctypes for protocol decoding\u003c\/li\u003e\n\u003cli\u003eExamine artifacts from mobile, Skype, and browsers\u003c\/li\u003e\n\u003cli\u003eDiscover how to utilize Python to improve the focus of your analysis\u003c\/li\u003e\n\u003cli\u003eInvestigate in volatile memory with the help of volatility on the Android and Linux platforms\u003cbr\u003e\n\u003c\/li\u003e\n\u003c\/ul\u003e\u003cb\u003eIn Detail\u003c\/b\u003e\u003cp\u003eDigital forensic analysis is the process of examining and extracting data digitally and examining it. Python has the combination of power, expressiveness, and ease of use that makes it an essential complementary tool to the traditional, off-the-shelf digital forensic tools.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThis book will teach you how to perform forensic analysis and investigations by exploring the capabilities of various Python libraries.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThe book starts by explaining the building blocks of the Python programming language, especially ctypes in-depth, along with how to automate typical tasks in file system analysis, common correlation tasks to discover anomalies, as well as templates for investigations. Next, we'll show you cryptographic algorithms that can be used during forensic investigations to check for known files or to compare suspicious files with online services such as VirusTotal or Mobile-Sandbox.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eMoving on, you'll learn how to sniff on the network, generate and analyze network flows, and perform log correlation with the help of Python scripts and tools. You'll get to know about the concepts of virtualization and how virtualization influences IT forensics, and you'll discover how to perform forensic analysis of a jailbroken\/rooted mobile device that is based on iOS or Android.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eFinally, the book teaches you how to analyze volatile memory and search for known malware samples based on YARA rules.\u003c\/p\u003e\u003cp\u003e\u003cb\u003eStyle and approach\u003c\/b\u003e\u003c\/p\u003e\u003cp\u003eThis easy-to-follow guide will demonstrate forensic analysis techniques by showing you how to solve real-word-scenarios step by step.\u003c\/p\u003e\u003cp\u003e\u003cbr\u003e\u003c\/p\u003e","brand":"Packt Publishing","offers":[{"title":"Default Title","offer_id":47150170603760,"sku":"9781783988051","price":31.99,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0737\/7593\/9824\/files\/9781783988051_p0.jpg?v=1763724745","url":"https:\/\/shop-qa.barnesandnoble.com\/products\/9781783988051","provider":"Barnes \u0026 Noble (DEV)","version":"1.0","type":"link"}