Pytsk

pytsk is a Python binding for the SleuthKit.

This is a Python binding against the libtsk (SleuthKit library). The aim is to make the binding reflect the TSK API as much as possible in capabilities, while at the same time having a nice Pythonic OO interface:

4.12.1: https://www.sleuthkit.org/sleuthkit/docs/api-docs/4.12.1/

NOTE: Currently the 4.14.0 API docs are not available, 4.12.1 is the closest.

WARNING: use pytsk at your own risk. libtsk is known to have many defects. For processing data from untrusted sources it is highly recommended to add additional security measures, such as a security sandbox.

If downloaded pytsk using git you'll have to first run:

python setup.py update

If you want to use the latest version of Sleuthkit that is checked into git (also known as HEAD), instead of the currently supported version, you can run:

python setup.py update --use-head

To build the bindings just use the standard Python setuptools:

python setup.py build python setup.py install

At the top level of the source tree.

The Python binding is autogenerated from the libtsk header files using a small OO C shim. This means that most of the fields in many of the structs are already available. We aim to provide most of the functionality using this shim (e.g. traversing and iterating over lists etc). The authoritative source of documentation is the library API linked above.