1. “At a basic level, digital data is a series of very small units on storage device that are set to 0 or 1 with the 0 or 1 representing a microscopic physical condition, often a level of electric charge, on the media. Each individual unit is called a bit” (Vincze, 2016)

2. “Each individual unit is called a bit, and groups of eight bits are called ____ . Each _____ represents a ______ value, and groups of _____ values form numbers, letters, words, and all other manifestations of information stored on computers and their related devices”
Fill in the blanks:
Byte(s)
Hexadecimal

3. Create a “.txt”, “.doc”, and “.docx”
Write “Hello” in all of them
Convert “Hello” to its Hexadecimal Equivalent
Open the “.txt” file, the “.doc” file, and the “.docx” file in the hexadecimal viewer

4. Digital Forensics Analysis of Files:
Keyword Search (Files that contain a name, an expression)
Regular Expressions Search (Files that contain a credit card number, a phone number, a bank account, an ip address)
Location of File: Cached file ?

5. Police sources said the two had a rocky relationship and the Twitter messages they posted - with friends jumping in - only made it worse.
Hours before the shooting, Dancy may have taunted Blake with a tweet: "N-----s is lookin for u don't think I won't give up ya address for a price betta chill asap!"
Blake's Twitter account is also full of online disses, though only one tweet mentions Dancy by name: "R.I.P. Kwame" on Dec.3.

6. “[e]ach time a web page is opened, it is sent to your browser’s temporary cache on the computer hard drive. If that page is accessed again and has not been modified, the browser will open the page from the previously saved cache instead of downloading the page again”
(Brunty, 2012)

7. “Criticism ranged from claims that they ‘dumb down’ the digital investigative process to suggestions that they allow a deterioration of expert knowledge by an over reliance on automation and produce a less thorough, or lower quality, investigation” (Vincze, 2016)

8. “[e]ach time a web page is opened, it is sent to your browser’s temporary cache on the computer hard drive. If that page is accessed again and has not been modified, the browser will open the page from the previously saved cache instead of downloading the page again”
(Brunty, 2012)
Check your cached files
What evidence do they reveal?

9. Objectives:
Hashing Files
Hashing all files in a folder
Keyword searching: Listing the files the .txt files that contain a word
Deleting duplicates: Deleting all duplicates of a file

10. Hashing a file import hashlib file1 = open("file1.txt","rb")
fileContent = file1.read()
m = hashlib.md5()
m.update(fileContent)
print(m.hexdigest())
a = input("press any key to exit")

11. Hashing all .txt files in a folder
import os
import hashlib
folder = os.listdir(".")
for name in folder:
if(name.endswith(".txt")):
file1 = open(name, "rb")
fileContent = file1.read()
m = hashlib.md5()
m.update(fileContent)
file1.close()
print(m.hexdigest())
a = input("press any key to exit")
Write the hashes to a file instead of printing them
Hash all files in a directory called NewFolder
Use os.listdir(“NewFolder”)
Use name2 = “NewFolder/” + name

12. Listing files that contain the word hello
import os
import hashlib
folder = os.listdir(".")
for name in folder:
if(name.endswith(".txt")):
file1 = open(name, "r")
fileContent = file1.read()
if("hello" in fileContent):
print(name)
print("\n")
a = input("press any key to exit")

13. Deleting a file
import os
os.remove("file1.txt")

14. Deleting if it contains the word ‘hello’
import os
import hashlib
folder = os.listdir(".")
for name in folder:
if(name.endswith(".txt")):
file1 = open(name, "r")
fileContent = file1.read()
file1.close()
if("hello" in fileContent):
try:
os.remove(name)
except Exception as e:
print(e)
a = input("press any key to exit")
1. Create a python script that creates a file that contains a list of the files that contain the word ‘kill’

15. Removing Duplicates of the file f1.txt
import os
import hashlib
items = os.listdir(".")
hasher = hashlib.md5()
file = open("f.txt", "rb")
file2 = file.read()
hasher.update(file2)
h1 = hasher.hexdigest()
for nn in items:
file = open(nn, "rb")
h2 = hasher.hexdigest()
file.close()
if(h1 == h2 and nn != 'f.txt'):
print(nn)
try:
os.remove(nn)
except:
print("failed")
e = input("press any key to exit")
Removing Duplicates of the file f1.txt
The script removes all duplicates of the file f.txt
How do we create a script that remove all duplicates?