skip to navigation
skip to content

pytsk3 20140320

Python bindings for the SleuthKit

Latest Version: 20160207.post1

pytsk is a Python binding for the SleuthKit.

The SleuthKit is a complete filesystem analysis tool. In the past PyFlag shipped a Python binding for a statically compiled version which was incorporated in the PyFlag source tree (Version 2.78). That version is now very old and does not support HFS+ which SleuthKit 3.1 does. At the time there were some important functions that we needed to link to but the old libtsk (the shared object produced by older SleuthKit binaries) did not export these - which is the reason for incorporating a slightly modified version in the source tree.

These days things are much better - libtsk3 is designed to be a general purpose library with many useful functions linked in. The overall architecture has been tremendously improved and it is now very easy to use it from an external program.

This is a Python binding against the libtsk3 shared object. Our aim is to make the binding reflect the TSK API as much as possible in capabilities, while at the same time having a nice Pythonic OO interface:

The new binding just links to libtsk3 which should make it easier to maintain against newer versions. We should be able to rewrite all the SleuthKit tools in Python (using the library and bindings) as a demonstration of what is possible with the new bindings. This page documents how to use the binding from a practical point of view - we want to show examples of how to do some common tasks.

File Type Py Version Uploaded on Size
pytsk3-20140320.tgz (md5) Source 2014-04-26 90KB
pytsk3-20141220.tgz (md5) Source 2014-12-23 92KB
  • Downloads (All Versions):
  • 4 downloads in the last day
  • 744 downloads in the last week
  • 1211 downloads in the last month