Python is usually referred to as a scripting language which is why the question arises, why python is used for computer forensics.
Well, this programming language is a general-purpose language that has clear syntax and a comprehensive standard library. Experts chose this to develop information security toolkits. Because of its modular human-readable code experts can easily develop security tools for use in forensics. Some of the situations that python is helpful in computer forensics include:
Conversion, Harsh, and Crypto Function: In cases where forensic experts find a target who attempts to hide information – In most cases they will use ROT- 13. Using python the expert is able to utilize the libraries to create a solution to access the hidden information. The python coding language helps to decode the encryption in different ways and provide clear information on the other end. Python can also help to decrypt passwords placed on documents so that they appear in the original text and a document unlocked.
Metadata extraction: in computer forensic investigations, it is very important that you are able to determine who created a particular file or document, where it was created and when along with other metadata. When you use python, you can create a script that will enable quick access to such information. For example, if you are investigating images on a phone and you would like to find out where they were taken, the script will be able to use Google maps to plot the locations where the pictures were taken, what time as well as by who. It is even possible to write a script that will automate the process of retrieving the metadata from a computer during the forensic investigation.
Studying Microsoft artifacts: The Windows registry has a lot of configuration settings and options that make carrying out forensics a bit tiresome. To make the investigation into the configurations easier, a python script can be created to narrow down the number of locations to be checked for different information. Python can give you a series of keystrokes to guide you towards figuring out what files were accessed, using particular systems and in the end provide the needed information for the investigation.
The general reason why python is used for computer forensics if the fact that it is a reasonably simple scripting language with a number of libraries so it becomes easy for experts to create different scripts for particular tasks.