Processing files within the container

Recipe Difficulty: Medium

Python Version: 2.7

Operating System: Linux

Now that we can iterate through a filesystem, let's look at how we can create file objects as we have been accustomed to doing. In this recipe, we create a simple triage script that extracts files matching specified file extensions and copies them to an output directory while preserving their original file path.

Getting started

Refer to the Getting started section in the Opening Acquisitions recipe for information on the build environment and setup details for pytsk3 and pyewf. All other libraries used in this script are present in Python's standard library.

How to do it...

We will perform the following steps in this recipe:

1. Identify if the evidence container is a raw image or an E01 container.
2. Access the image using pytsk3.
3. Recurse through all directories in each partition.
4. Check if the file extension matches those supplied.
5. Write responsive files with the preserved folder structure to the output...