pytsk is a Python binding for the SleuthKit. The SleuthKit is a complete filesystem analysis tool. https://github.com/py4n6/pytsk

import pytsk3
import os

imagefile = "/evidence/laptop.img"
imagehandle    = pytsk3.Img_Info(imagefile)
partitionTable = pytsk3.Volume_Info(imagehandle)

list_of_partitions = []
display_info = []


for partition in partitionTable:
    print(partition.addr, partition.desc.decode("utf-8"), partition.len, partition.start)
    list_of_partitions.append(partition) #takes each partition and puts it into the list_of_partitions above

0 Primary Table (#0) 1 0
1 Unallocated 2048 0
2 NTFS / exFAT (0x07) 204800 2048
3 NTFS / exFAT (0x07) 125620224 206848
4 Unallocated 2048 125827072

The fourth partition is the largest and probably the one we want.

c_drive = list_of_partitions[3]
#We need to open the whole image and seek to the offset where the volume starts
filesystemObject = pytsk3.FS_Info(imagehandle, offset=(c_drive.start*512))

#Since probably we need to list files than once, lets make it a function!
def listFilesAndFolders(strpath):
    directoryObject = filesystemObject.open_dir(path=strpath)
    for entryObject in directoryObject:
        fs_object = entryObject.info.name.name.decode('utf-8')
        print(os.path.join(strpath,fs_object))

listFilesAndFolders('/Windows/System32/config')

#("/") used to get to root, and see most valuable file = $MFT
#('/Windows/')
#("/Users/peter/appdata/roaming/microsoft/windows/recent") # remove "#" and join together for all info



/Windows/System32/config/.
/Windows/System32/config/..
/Windows/System32/config/COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
/Windows/System32/config/SECURITY.LOG2
/Windows/System32/config/BCD-Template
/Windows/System32/config/BCD-Template.LOG
/Windows/System32/config/COMPONENTS
/Windows/System32/config/COMPONENTS.LOG
/Windows/System32/config/COMPONENTS.LOG1
/Windows/System32/config/COMPONENTS.LOG2
/Windows/System32/config/COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TM.blf
/Windows/System32/config/COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
/Windows/System32/config/COMPONENTS{a0ee2d84-a280-11e9-973f-784f436107a8}.TxR.1.regtrans-ms
/Windows/System32/config/COMPONENTS{a0ee2d84-a280-11e9-973f-784f436107a8}.TxR.blf
/Windows/System32/config/COMPONENTS{a0ee2d85-a280-11e9-973f-784f436107a8}.TM.blf
/Windows/System32/config/COMPONENTS{a0ee2d85-a280-11e9-973f-784f436107a8}.TMContainer00000000000000000001.regtrans-ms
/Windows/System32/config/COMPONENTS{a0ee2d85-a280-11e9-973f-784f436107a8}.TMContainer00000000000000000002.regtrans-ms
/Windows/System32/config/TxR
/Windows/System32/config/DEFAULT
/Windows/System32/config/DEFAULT.LOG
/Windows/System32/config/DEFAULT.LOG1
/Windows/System32/config/DEFAULT.LOG2
/Windows/System32/config/Journal
/Windows/System32/config/RegBack
/Windows/System32/config/SAM
/Windows/System32/config/SAM.LOG
/Windows/System32/config/SAM.LOG1
/Windows/System32/config/SAM.LOG2
/Windows/System32/config/SECURITY
/Windows/System32/config/SECURITY.LOG
/Windows/System32/config/SECURITY.LOG1
/Windows/System32/config/SECURITY.LOG1
/Windows/System32/config/SOFTWARE
/Windows/System32/config/SOFTWARE.LOG
/Windows/System32/config/SOFTWARE.LOG1
/Windows/System32/config/SOFTWARE.LOG2
/Windows/System32/config/SYSTEM
/Windows/System32/config/SYSTEM.LOG
/Windows/System32/config/SYSTEM.LOG1
/Windows/System32/config/SYSTEM.LOG2
/Windows/System32/config/systemprofile
/Windows/System32/config/TxR
/Windows/System32/config/COMPONENTS{a0ee2d84-a280-11e9-973f-784f436107a8}.TxR.1.regtrans-ms
/Windows/System32/config/COMPONENTS{a0ee2d84-a280-11e9-973f-784f436107a8}.TxR.2.regtrans-ms
/Windows/System32/config/COMPONENTS{a0ee2d84-a280-11e9-973f-784f436107a8}.TxR.0.regtrans-ms
/Windows/System32/config/COMPONENTS{a0ee2d84-a280-11e9-973f-784f436107a8}.TxR.2.regtrans-ms

from datetime import datetime

def carvefile(path):
    print("\nCarving %s " % path)
    fileobject = filesystemObject.open(path)
    filename = path.split('/')[-1]
    print ("File Inode:",fileobject.info.meta.addr)
    print ("File Name:",fileobject.info.name.name)
    print ("File Creation Time:",datetime.fromtimestamp(fileobject.info.meta.crtime).strftime('%Y-%m-%d %H:%M:%S'))
    with open(filename, 'wb') as outputfile:
        filedata = fileobject.read_random(0,fileobject.info.meta.size)
        outputfile.write(filedata)

carvefile("/Windows/System32/config/SAM")


Carving /Windows/System32/config/SAM
File Inode: 41272
File Name: b'SAM'
File Creation Time: 2009-07-14 02:03:40

import hashlib
with open("SAM",'rb') as inputfile:
    hash_object = hashlib.md5(inputfile.read())
    print(hash_object.hexdigest())

38629284a412203ed22dc82a5c55c885