def testListFiles_alternateDataStreams_fileOnly(self):
with self._client.Open(path="\\ads\\ads.txt") as file_obj:
files = file_obj.ListFiles()
files = list(files)
files.sort(key=lambda x: x.name)
expected_files = [
filesystem_pb2.StatEntry(
name="ads.txt",
st_ino=ADS_ADS_TXT_FILE_REF,
stream_name="one",
st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"),
st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"),
st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
ntfs=S_DEFAULT_FILE,
st_size=6,
),
filesystem_pb2.StatEntry(
name="ads.txt",
st_ino=ADS_ADS_TXT_FILE_REF,
stream_name="two",
st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"),
st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"),
st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
ntfs=S_DEFAULT_FILE,
st_size=7,
),
]
self.assertEqual(files, expected_files)
def testListFiles_alternateDataStreams(self):
with self._client.Open(path=self._Path("\\ads")) as file_obj:
files = file_obj.ListFiles()
files = list(files)
files.sort(key=lambda x: x.name)
expected_files = [
self._ExpectedStatEntry(
filesystem_pb2.StatEntry(
name="ads.txt",
st_ino=self._FileRefToInode(ADS_ADS_TXT_FILE_REF),
st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"),
st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"),
st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
ntfs=S_DEFAULT_FILE,
st_size=5,
st_gid=0,
st_uid=48,
st_nlink=1,
st_mode=S_MODE_DEFAULT,
)),
self._ExpectedStatEntry(
filesystem_pb2.StatEntry(
name="ads.txt",
st_ino=self._FileRefToInode(ADS_ADS_TXT_FILE_REF),
stream_name="one",
st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"),
st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"),
st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
ntfs=S_DEFAULT_FILE,
st_size=6,
st_gid=0,
st_uid=48,
st_nlink=1,
st_mode=S_MODE_DEFAULT,
)),
self._ExpectedStatEntry(
filesystem_pb2.StatEntry(
name="ads.txt",
st_ino=self._FileRefToInode(ADS_ADS_TXT_FILE_REF),
stream_name="two",
st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"),
st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"),
st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"),
ntfs=S_DEFAULT_FILE,
st_size=7,
st_gid=0,
st_uid=48,
st_nlink=1,
st_mode=S_MODE_DEFAULT,
)),
]
self.assertEqual(files, expected_files)
def _Stat(
self,
fd: pytsk3.File,
data_stream: Optional[pytsk3.Attribute],
) -> filesystem_pb2.StatEntry:
st = filesystem_pb2.StatEntry()
if fd.info.name is not None:
name = fd.info.name
if name.name is not None:
st.name = _DecodeName(name.name)
st.st_mode |= _FS_NAME_TYPE_LOOKUP.get(int(name.type), 0)
if fd.info.meta is not None:
meta = fd.info.meta
if hasattr(meta, "mode"):
st.st_mode |= _FixInt(int(meta.mode))
if hasattr(meta, "nlink"):
st.st_nlink = _FixInt(meta.nlink)
if hasattr(meta, "uid"):
st.st_uid = _FixInt(meta.uid)
if hasattr(meta, "gid"):
st.st_gid = _FixInt(meta.gid)
if hasattr(meta, "addr"):
st.st_ino = meta.addr
if hasattr(meta, "atime"):
st.st_atime.FromSeconds(_FixInt(meta.atime))
if hasattr(meta, "mtime"):
st.st_mtime.FromSeconds(_FixInt(meta.mtime))
if hasattr(meta, "crtime"):
st.st_btime.FromSeconds(_FixInt(meta.crtime))
if hasattr(meta, "ctime"):
st.st_ctime.FromSeconds(_FixInt(meta.ctime))
if hasattr(meta, "type"):
st.st_mode |= _FS_META_TYPE_LOOKUP.get(_FixInt(int(meta.type)),
0)
if hasattr(meta, "size"):
if not stat.S_ISDIR(st.st_mode):
st.st_size = _FixInt(meta.size)
if data_stream is not None:
if data_stream.info.name is not None:
st.stream_name = _DecodeName(data_stream.info.name)
st.st_size = data_stream.info.size
if self._fs_info.info.ftype == pytsk3.TSK_FS_TYPE_NTFS:
st.st_mode = _FixNtfsMode(st.st_mode)
return st
def _Stat(
self,
entry: pyfsntfs.file_entry,
data_stream: pyfsntfs.data_stream,
) -> filesystem_pb2.StatEntry:
st = filesystem_pb2.StatEntry()
if entry.name is not None:
st.name = entry.name
st.st_ino = entry.file_reference
st.st_atime.FromDatetime(entry.get_access_time())
st.st_mtime.FromDatetime(entry.get_modification_time())
st.st_btime.FromDatetime(entry.get_creation_time())
st.st_ctime.FromDatetime(entry.get_entry_modification_time())
st.ntfs.is_directory = entry.has_directory_entries_index()
if not entry.has_directory_entries_index() and data_stream is not None:
st.st_size = data_stream.get_size()
if entry != data_stream and data_stream is not None:
st.stream_name = data_stream.name
st.ntfs.flags = entry.file_attribute_flags
return st
def testListFiles(self):
with self._client.Open(path=self._Path("\\")) as file_obj:
files = file_obj.ListFiles()
files = [f for f in files if not f.name.startswith("$")]
files = list(files)
files.sort(key=lambda x: x.name)
expected_files = [
self._ExpectedStatEntry(
filesystem_pb2.StatEntry(
name="a",
st_ino=self._FileRefToInode(A_FILE_REF),
st_atime=_ParseTimestamp("2020-03-03 16:48:16.371823"),
st_btime=_ParseTimestamp("2020-03-03 16:47:43.605063"),
st_mtime=_ParseTimestamp("2020-03-03 16:47:50.945764"),
st_ctime=_ParseTimestamp("2020-03-03 16:47:50.945764"),
ntfs=S_DEFAULT_DIR,
st_gid=0,
st_uid=48,
st_nlink=1,
st_mode=S_MODE_DIR,
)),
self._ExpectedStatEntry(
filesystem_pb2.StatEntry(
name="ads",
st_ino=self._FileRefToInode(ADS_FILE_REF),
st_atime=_ParseTimestamp("2020-04-07 14:57:02.655592"),
st_btime=_ParseTimestamp("2020-04-07 13:23:07.389499"),
st_mtime=_ParseTimestamp("2020-04-07 14:56:47.778178"),
st_ctime=_ParseTimestamp("2020-04-07 14:56:47.778178"),
ntfs=S_DEFAULT_DIR,
st_gid=0,
st_uid=48,
st_nlink=1,
st_mode=S_MODE_DIR,
)),
self._ExpectedStatEntry(
filesystem_pb2.StatEntry(
name="hidden_file.txt",
st_ino=self._FileRefToInode(HIDDEN_FILE_TXT_FILE_REF),
st_atime=_ParseTimestamp("2020-04-08 20:14:38.260081"),
st_btime=_ParseTimestamp("2020-04-08 20:14:38.259955"),
st_mtime=_ParseTimestamp("2020-04-08 20:14:38.260081"),
st_ctime=_ParseTimestamp("2020-04-08 20:15:07.835354"),
ntfs=filesystem_pb2.StatEntry.Ntfs(
is_directory=False,
flags=stat.FILE_ATTRIBUTE_ARCHIVE
| stat.FILE_ATTRIBUTE_HIDDEN),
st_size=0,
st_gid=0,
st_uid=48,
st_nlink=1,
st_mode=S_MODE_HIDDEN,
)),
self._ExpectedStatEntry(
filesystem_pb2.StatEntry(
name="numbers.txt",
st_ino=self._FileRefToInode(NUMBERS_TXT_FILE_REF),
st_atime=_ParseTimestamp("2020-03-03 20:10:46.353317"),
st_btime=_ParseTimestamp("2020-03-03 16:46:00.630537"),
st_mtime=_ParseTimestamp("2020-03-03 20:10:46.353317"),
st_ctime=_ParseTimestamp("2020-03-03 20:10:46.353317"),
ntfs=S_DEFAULT_FILE,
st_size=3893,
st_gid=0,
st_uid=48,
st_nlink=1,
st_mode=S_MODE_DEFAULT,
)),
self._ExpectedStatEntry(
filesystem_pb2.StatEntry(
name="read_only_file.txt",
st_ino=self._FileRefToInode(
READ_ONLY_FILE_TXT_FILE_REF),
st_atime=_ParseTimestamp("2020-04-08 20:14:33.306681"),
st_btime=_ParseTimestamp("2020-04-08 20:14:33.306441"),
st_mtime=_ParseTimestamp("2020-04-08 20:14:33.306681"),
st_ctime=_ParseTimestamp("2020-04-08 20:14:55.254657"),
ntfs=filesystem_pb2.StatEntry.Ntfs(
is_directory=False,
flags=stat.FILE_ATTRIBUTE_ARCHIVE
| stat.FILE_ATTRIBUTE_READONLY),
st_size=0,
st_gid=0,
st_uid=48,
st_nlink=1,
st_mode=S_MODE_READ_ONLY,
)),
self._ExpectedStatEntry(
filesystem_pb2.StatEntry(
name="入乡随俗 海外春节别样过法.txt",
st_ino=self._FileRefToInode(CHINESE_FILE_FILE_REF),
st_atime=_ParseTimestamp("2020-06-10 13:34:36.872637"),
st_btime=_ParseTimestamp("2020-06-10 13:34:36.872637"),
st_mtime=_ParseTimestamp("2020-06-10 13:34:36.872802"),
st_ctime=_ParseTimestamp("2020-06-10 13:34:36.872802"),
ntfs=S_DEFAULT_FILE,
st_size=26,
st_gid=0,
st_uid=48,
st_nlink=1,
st_mode=S_MODE_DEFAULT,
)),
]
self.assertEqual(files, expected_files)
