Learning Python for Forensics

Additional challenges

For this project, we invite you to implement some improvements that will make our script more versatile. As mentioned earlier in the chapter, pypff does not currently natively support the extraction or direct interaction with attachments. We can, however, call the pffexport and pffinfo tools within our Python script to do so. We recommend looking at the subprocess module to accomplish this. To extend this further, how can we connect this with the code covered in Chapter 8, The Media Age What type of data might become available once we have access to the attachments?

Consider methods that would allow a user to provide filtering options to collect specific messages of interest rather than the entire PST. A library that may assist ...