Learning Python for Forensics
上QQ阅读APP看书,第一时间看更新

Working with Serialized Data Structures

In this chapter, we'll develop greater skills while working with nested lists and dictionaries by manipulating JavaScript Object Notation (JSON) structured data. Our artifact of interest is raw Bitcoin account data that contains, among other things, a list of all sent and received transactions. We'll access this dataset using a web Application Programming Interface (API) and parse it in a manner conducive to analysis.

APIs are created for software products and allow programmers to interface with the software in defined ways. Publicly accessible APIs aren't always available for the given software. When available, they expedite code development by offering methods to interact with the software, as the APIs will handle lower-level implementation details. Developers implement APIs to encourage others to build supporting programs and, additionally, control the manner in which other developers' code interacts with their software. By creating an API, developers are giving other programmers a controlled manner of interfacing with their program.

In this chapter, we'll use the web API from https://www.blockchain.info to query and receive Bitcoin account information for a given Bitcoin address. The JSON data that this API generates can be converted into Python objects using the JSON module from the standard library. Instructions and examples of their API can be found at https://www.blockchain.info/api/blockchain_api.

In this chapter, we'll cover the following:

  • Discussing and manipulating serialized structures including Extensible Markup Language (XML) and JSON data
  • Creating logs with Python
  • Reporting results in a CSV output format
The code for this chapter was developed and tested using Python 2.7.15 and Python 3.7.1. The bitcoin_address_lookup.v1.py and bitcoin_address_lookup.v2.py scripts were developed to work with Python 3.7.1 and not Python 2.7.15.