Lucas, a forensic investigator, is working on an investigation involving a compromised hard drive.

According to CHFI v11 objectives underComputer Forensics FundamentalsandDigital Forensics using Python, investigators are encouraged to automate forensic analysis tasks to improve efficiency, accuracy, and repeatability. The Sleuth Kit (TSK) is a widely used open-source forensic toolkit for analyzing disk images, file systems, and recovering deleted files. To extend these capabilities using Python, CHFI v11 highlights the use of Python bindings specifically designed for forensic purposes.

PyTSK (also known as pytsk3) is the official Python binding for The Sleuth Kit. It allows forensic investigators to programmatically access disk images, partitions, file systems, directories, and file metadata directly from Python scripts. This enables automation of tasks such as file enumeration, timeline creation, deleted file recovery, and artifact extraction—core activities in disk and file system forensics.

The other options are not suitable in this context. NumPy is designed for numerical computation, PyTorch is used for machine learning, and PySpark is intended for big data processing. None of these tools integrate with Sleuth Kit or provide native disk forensic analysis capabilities. Therefore, PyTSK is the correct and CHFI-aligned choice for Python-based Sleuth Kit forensic automation.