Learning Python for Forensics

Introducing our script

The setupapi_parser.py script will be developed to parse the setupapi.dev.log file on Windows 7 and higher. Equipped with only modules from the standard library, we will open and read a setupapi.log file, identify and parse relevant USB information, and display it to the user in the console. As mentioned in the introduction, we will use an iterative build process to mimic a natural development cycle. Each iteration will build upon the previous while we explore new features and methods. We will encourage the development of additional iterations with challenges at the end of the chapter.

Overview

Before developing any code, let's identify the requirements and features our script must possess to accomplish the desired task. We ...