DFIR Python Study Group: Class 4

Starting off this post with a shortcut I love to use in Atom: Highlight as many lines as you want to “comment out” and hit CTRL+/ 

This will comment out everything that was highlighted. I use this a lot when I just want to run a small portion of code.

In class 4, we focused on finishing up Chapter 2 of Head First Python, 2nd edition by Paul Barry. Chapter 2 is all about lists.

As a refresher, we created a few lists using the two different methods we learned – brackets [ ] and list(). *Tip from Alexis: if you plan on using a single quotation in your string, you must use double quotation marks to enclose the string. If you don’t, you will encounter an error.

Three lists:




We then revisit join and slice. Remember our “Don’t Panic!” challenge? We had the challenge of changing the string “Don’t Panic!” into “on tap” using the code we had learned in Chapter 1 and 2. We go through this again, but instead, we utilize a nondestructive method using join and slice. “A slice is a fragment of a list” (Barry, 2016). Using pop (like we did in the first solution of this challenge) actually amends/removes the characters in those positions of the list and we lose that original data. By using slice and join, we are creating a new variable and ‘pulling’ characters out of our list by ‘calling’ on them.

When I first ran this, I got an error (below)


Oops. The reason I got this error is because I forgot to add in another set of brackets enclosing the list inside of join. Don’t do what I did, use your brackets.

Here is the correct code:


And here is the result we want to see:


Moving on…

We start to use tabs ‘\t’ with our lists, we also use loops, and start, stop and step arguments. In our code, our tab is used and then multiplied. The result is just as what you would expect when you press the tab button that many times on the keyboard. Tab once. Tab twice. Tab three times.


Result (pretty cool if you ask me):


And remember, we’re not seeing Marvin Paranoid Android in order like it is in our original string because in our second for loop, we’re calling on the last 7 characters, which is Android, and THEN we end with another for loop that calls out Paranoid (starting at 12, stopping at 20).

Chapter 2 ends with why lists are wonderful but aren’t great for everything. While lists can be super helpful, they prove inadequate when you’re using structured data. Structured data is organized data, like what we see in spreadsheets. Key/value pairs are allowed when using a dictionary. Dictionary is pre-built into Python and will be discussed in Chapter 3. 

I was planning on starting Chapter 3 in my next blog post, but I want to split up the DFIR Class 4 into two posts. This will allow me to practice the code we used last time that pulls information from a file and using something new - rstrip() which will remove a new line from our string (the spaces between our results).


DFIR Python Study Group: Class 4

Atom - text editor I use

Head First Python 2nd Edition by Paul Barry (links to Amazon)