Automating Filesystem Artifact Analysis in Linux Environments Using Python

Manual execution of command-line analysis tools can be inefficient and difficult to maintain when applied to complex data processing workflows. This paper presents a Python-based automation approach for filesystem artifact analysis in Linux environments, focusing on improving maintainability, readability, and structured reporting. The proposed solution integrates existing low-level analysis tools into modular Python scripts that automate file enumeration, metadata extraction, and artifact processing. The implementation demonstrates three automated workflows: identification and extraction of deleted filesystem entries, detection and classification of NTFS Alternate Data Streams, and parsing of structured system data files to extract user-related information. The system is designed using object-oriented principles and provides structured output in JSON, CSV, and human-readable text formats. Experimental evaluation shows that the Python-based approach reduces manual effort, improves reproducibility, and simplifies result interpretation compared to traditional shell-based scripting. The results indicate that Python offers a practical and scalable foundation for automating complex analysis workflows in Linux-based systems, particularly when structured data processing and reporting are required.