def test_from_raw(self): raw_data = self.partition.read_data(self.partition.boot_sector.get_mft_start_bytes_offset(), 1024) record = Record.from_raw(raw_data) # test mft entry header self.assertEqual(0x454c4946, record.signature) self.assertTrue(record.is_valid()) self.assertFalse(record.is_deleted()) self.assertTrue(record.is_file()) # test $FILE_NAME attribute self.assertEqual('$MFT', record.attrs['file_name']) # test $DATA attribute expected_data_runs = [(19, 4)] self.assertTrue('data_runs' in record.attrs) self.assertListEqual(expected_data_runs, record.attrs['data_runs']) self.assertEqual(0, record.record_number)
def test_turing_jpg_from_raw(self): raw_data = self.partition.read_data(81920, 1024) record = Record.from_raw(raw_data) # test mft entry header self.assertEqual(0x454c4946, record.signature) self.assertTrue(record.is_valid()) self.assertFalse(record.is_deleted()) self.assertTrue(record.is_file()) # test $FILE_NAME attribute self.assertEqual(1, record.seq_no) self.assertEqual(5, record.attrs['parent_dir_file_req_no']) self.assertEqual(5, record.attrs['parent_dir_seq_no']) self.assertEqual('Alan_Turing.jpg', record.attrs['file_name']) # test $DATA attribute expected_data_runs = [(17, 123751)] self.assertTrue('data_runs' in record.attrs) self.assertListEqual(expected_data_runs, record.attrs['data_runs']) self.assertEqual(64, record.record_number)