Visualising Data with Pandas
15 June 2020
As part of my quest to improve my Python skills I've been learning how to visualise data using Pandas. When we parse out large data sets from logs or other artefacts recovered from forensics data it can be difficult to glean real-world meaning from tables and lists of numbers. Visualising this data is extremely useful in understanding the story it tells, more easily spotting patterns or interesting anomalies and answering the crucial questions who, what, when, where and why?
Pandas is a Python Data Analysis Library: https://pandas.pydata.org/about/index.html
As a complete Pandas beginner I did the following 2 Pluralsight courses as an introduction to this:
These courses use Jupyter Notebooks and Spyder which are both included when you download Anaconda. Included in the course materials are pre-prepared Jupyter notebook files so you can follow along with the instructor's examples.
I thought Spyder was particularly beginner-friendly because it made the "data frames" (the data structures used by Pandas) so much easier to understand by displaying them to you graphically in the "variable explorer" along with any other variables you are using. In this case my data frame ("df") was imported from a csv of data about artworks provided by Pluralsight.
Double clicking on a data frame opens it up:
This makes for easy viewing so you don't have to memorise/imagine what your data structures look like but also has the benefit of being directly convertable/editable:
Fig 3 Fig 4
iOS Battery Levels
For my first attempt at implementing this for something forensic-y I wanted a dataset that was more than just plotting one value against another. I settled on using some iOS battery level data from the iOS 13 sample data posted by the Binary Hick. There would be the battery level vs timestamp data but I could add a further element to indicate whether the phone was plugged in and charging or unplugged and discharging. Hopefully these two would combine to show that the battery goes up when the phone is charging and goes down when it's not!
This is my code: