Beispiel #1
0
def test_different_la():
    f = open(MFT_DIFFERENT_LA, 'rb')

    c_1 = 0
    c_2 = 0

    mft = MFT.MasterFileTableParser(f)
    for file_record in mft.file_records():
        paths = mft.build_full_paths(file_record)

        if len(paths) == 0:
            continue

        assert len(paths) == 1
        path = paths[0]

        if path == '/ts_la/test_la.txt':
            for attr in file_record.attributes():
                attr_value = attr.value_decoded()

                if type(attr_value) is not Attributes.StandardInformation:
                    continue

                c_1 += 1
                ts_m_1 = attr_value.get_mtime()
                ts_a_1 = attr_value.get_atime()
                ts_c_1 = attr_value.get_ctime()
                ts_e_1 = attr_value.get_etime()

        elif path == '/ts_la':
            for attr in file_record.attributes():
                attr_value = attr.value_decoded()

                if type(attr_value) is not Attributes.IndexRoot:
                    continue

                for index_entry in attr_value.index_entries():
                    attr_value = Attributes.FileName(
                        index_entry.get_attribute())

                    c_2 += 1
                    ts_m_2 = attr_value.get_mtime()
                    ts_a_2 = attr_value.get_atime()
                    ts_c_2 = attr_value.get_ctime()
                    ts_e_2 = attr_value.get_etime()

    assert c_1 == 1 and c_2 == 1
    assert ts_m_1 == ts_m_2 and ts_c_1 == ts_c_2 and ts_e_1 == ts_e_2 and ts_a_1 != ts_a_2
    assert ts_a_2 < ts_a_1

    f.close()
Beispiel #2
0
def test_file_name():
    with open(ATTR_FN, 'rb') as f:
        fn_raw = f.read()

    fn = Attributes.FileName(fn_raw)

    assert fn.get_file_name() == 'sseriffr.fon'

    atime = fn.get_atime()
    mtime = fn.get_mtime()
    ctime = fn.get_ctime()
    etime = fn.get_etime()

    assert ctime.year == 2004 and ctime.month == 8 and ctime.day == 19 and ctime.hour == 17 and ctime.minute == 1 and ctime.second == 3 and ctime.microsecond == 331068
    assert mtime.year == 2001 and mtime.month == 8 and mtime.day == 23 and mtime.hour == 18 and mtime.minute == 0 and mtime.second == 0 and mtime.microsecond == 0
    assert atime.year == 2004 and atime.month == 8 and atime.day == 19 and atime.hour == 17 and atime.minute == 1 and atime.second == 3 and atime.microsecond == 341082
    assert etime == atime