Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletter Hub
Free Learning
Arrow right icon
timer SALE ENDS IN
0 Days
:
00 Hours
:
00 Minutes
:
00 Seconds
Arrow up icon
GO TO TOP
Learning Python for Forensics

You're reading from   Learning Python for Forensics Learn the art of designing, developing, and deploying innovative forensic solutions through Python

Arrow left icon
Product type Paperback
Published in May 2016
Publisher Packt
ISBN-13 9781783285235
Length 488 pages
Edition 1st Edition
Languages
Concepts
Arrow right icon
Authors (2):
Arrow left icon
Preston Miller Preston Miller
Author Profile Icon Preston Miller
Preston Miller
Chapin Bryce Chapin Bryce
Author Profile Icon Chapin Bryce
Chapin Bryce
Arrow right icon
View More author details
Toc

Table of Contents (18) Chapters Close

Preface 1. Now For Something Completely Different FREE CHAPTER 2. Python Fundamentals 3. Parsing Text Files 4. Working with Serialized Data Structures 5. Databases in Python 6. Extracting Artifacts from Binary Files 7. Fuzzy Hashing 8. The Media Age 9. Uncovering Time 10. Did Someone Say Keylogger? 11. Parsing Outlook PST Containers 12. Recovering Transient Database Records 13. Coming Full Circle A. Installing Python B. Python Technical Details
C. Troubleshooting Exceptions Index

Parsing Office metadata – office_parser.py


The last of the plugins, office_parser.py, parses DOCX, PPTX, and XLSX files, extracting embedded metadata in XML files. We use the zipfile module, which is part of the standard library, to unzip and access the contents of the Office document. This script has two functions: officeParser() and getTags().

001 import zipfile
002 import os
003 from time import gmtime, strftime
004  
005 from lxml import etree
006 import processors
007  
008 __author__ = 'Preston Miller & Chapin Bryce'
009 __date__ = '20160401'
010 __version__ = 0.01
011 __description__ = 'This scripts parses embedded metadata from office files'
012  
013 def officeParser():
...
028 def getTags():

Evaluating the officeParser() function

The officeParser() function first checks the input file against the known file signature. All Office documents share the same file signature, 0x504b030414000600, and if the input file matches, it is then further processed by the getTags() function, as...

lock icon The rest of the chapter is locked
CONTINUE READING
83
Tech Concepts
36
Programming languages
73
Tech Tools
Icon Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.
Icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Icon 50+ new titles added per month and exclusive early access to books as they are being written.
Learning Python for Forensics
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Modal Close icon
Modal Close icon