def testDataStreams(self):
"""Test the data streams functionality."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=1, parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
self.assertEqual(file_entry.number_of_data_streams, 1)
data_stream_names = []
for data_stream in file_entry.data_streams:
data_stream_names.append(data_stream.name)
self.assertEqual(data_stream_names, [u''])
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/', parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
self.assertEqual(file_entry.number_of_data_streams, 0)
data_stream_names = []
for data_stream in file_entry.data_streams:
data_stream_names.append(data_stream.name)
self.assertEqual(data_stream_names, [])
def testIsFunctions(self):
"""Test the Is? functions."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=1, parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
self.assertFalse(file_entry.IsRoot())
self.assertFalse(file_entry.IsVirtual())
self.assertFalse(file_entry.IsAllocated())
self.assertFalse(file_entry.IsDevice())
self.assertFalse(file_entry.IsDirectory())
self.assertTrue(file_entry.IsFile())
self.assertFalse(file_entry.IsLink())
self.assertFalse(file_entry.IsPipe())
self.assertFalse(file_entry.IsSocket())
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/', parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
self.assertTrue(file_entry.IsRoot())
self.assertTrue(file_entry.IsVirtual())
self.assertTrue(file_entry.IsAllocated())
self.assertFalse(file_entry.IsDevice())
self.assertTrue(file_entry.IsDirectory())
self.assertFalse(file_entry.IsFile())
self.assertFalse(file_entry.IsLink())
self.assertFalse(file_entry.IsPipe())
self.assertFalse(file_entry.IsSocket())
def testComparable(self):
"""Tests the path specification comparable property."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
parent=self._path_spec)
self.assertNotEqual(path_spec, None)
expected_comparable = u'\n'.join(
[u'type: TEST', u'type: TSK_PARTITION', u''])
self.assertEqual(path_spec.comparable, expected_comparable)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p2', parent=self._path_spec)
self.assertNotEqual(path_spec, None)
expected_comparable = u'\n'.join(
[u'type: TEST', u'type: TSK_PARTITION, location: /p2', u''])
self.assertEqual(path_spec.comparable, expected_comparable)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=1, parent=self._path_spec)
self.assertNotEqual(path_spec, None)
expected_comparable = u'\n'.join(
[u'type: TEST', u'type: TSK_PARTITION, part index: 1', u''])
self.assertEqual(path_spec.comparable, expected_comparable)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
start_offset=0x2000, parent=self._path_spec)
self.assertNotEqual(path_spec, None)
expected_comparable = u'\n'.join([
u'type: TEST', u'type: TSK_PARTITION, start offset: 0x00002000',
u''
])
self.assertEqual(path_spec.comparable, expected_comparable)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p2', part_index=1, parent=self._path_spec)
self.assertNotEqual(path_spec, None)
expected_comparable = u'\n'.join([
u'type: TEST',
u'type: TSK_PARTITION, location: /p2, part index: 1', u''
])
self.assertEqual(path_spec.comparable, expected_comparable)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
test_file = self._GetTestFilePath(['tsk_volume_system.raw'])
path_spec = os_path_spec.OSPathSpec(location=test_file)
self._tsk_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/', parent=path_spec)
def _TestRead(self, parent_path_spec):
"""Test the read functionality.
Args:
parent_path_spec (PathSpec): parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=6, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context)
partition_offset = 352 * self._BYTES_PER_SECTOR
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR)
file_object.seek(0x2e900 - partition_offset)
expected_data = (
b'\xc0\x41\x00\x00\x00\x30\x00\x00\xc8\x8c\xb9\x52\xc8\x8c\xb9\x52'
b'\xc8\x8c\xb9\x52\x00\x00\x00\x00\x00\x00\x02\x00\x18\x00\x00\x00'
)
self.assertEqual(file_object.read(32), expected_data)
file_object.close()
def setUp(self):
"""Sets up the needed objects used throughout the test."""
test_file = os.path.join(u'test_data', u'tsk_volume_system.raw')
path_spec = os_path_spec.OSPathSpec(location=test_file)
self._tsk_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/', parent=path_spec)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
test_file = self._GetTestFilePath(['mbr.raw'])
self._SkipIfPathNotExists(test_file)
path_spec = os_path_spec.OSPathSpec(location=test_file)
self._tsk_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/', parent=path_spec)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
self._resolver_context = context.Context()
test_file = self._GetTestFilePath(['tsk_volume_system.raw'])
self._os_path_spec = os_path_spec.OSPathSpec(location=test_file)
self._tsk_partition_path_spec = (
tsk_partition_path_spec.TSKPartitionPathSpec(
location='/', parent=self._os_path_spec))
def testSize(self):
"""Test the size property."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=2, parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
self.assertEqual(file_entry.size, 66048)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
self._resolver_context = context.Context()
test_file = os.path.join(u'test_data', u'tsk_volume_system.raw')
self._os_path_spec = os_path_spec.OSPathSpec(location=test_file)
self._tsk_partition_path_spec = (
tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/', parent=self._os_path_spec))
def testInitialize(self):
"""Tests the path specification initialization."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
parent=self._path_spec)
self.assertNotEqual(path_spec, None)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p2', parent=self._path_spec)
self.assertNotEqual(path_spec, None)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=1, parent=self._path_spec)
self.assertNotEqual(path_spec, None)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
start_offset=0x2000, parent=self._path_spec)
self.assertNotEqual(path_spec, None)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p2', part_index=1, parent=self._path_spec)
self.assertNotEqual(path_spec, None)
with self.assertRaises(ValueError):
_ = tsk_partition_path_spec.TSKPartitionPathSpec(parent=None)
with self.assertRaises(ValueError):
_ = tsk_partition_path_spec.TSKPartitionPathSpec(
parent=self._path_spec, bogus=u'BOGUS')
def GetRootFileEntry(self):
"""Retrieves the root file entry.
Returns:
TSKPartitionFileEntry: a file entry or None of not available.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=self.LOCATION_ROOT, parent=self._path_spec.parent)
return self.GetFileEntryByPathSpec(path_spec)
def GetRootFileEntry(self):
"""Retrieves the root file entry.
Returns:
A file entry (instance of vfs.FileEntry).
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=self.LOCATION_ROOT, parent=self._path_spec.parent)
return self.GetFileEntryByPathSpec(path_spec)
def testGetParentFileEntry(self):
"""Tests the GetParentFileEntry function."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=1, parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
parent_file_entry = file_entry.GetParentFileEntry()
self.assertIsNone(parent_file_entry)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
test_file = self._GetTestFilePath(['apfs.dmg'])
path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = raw_path_spec.RawPathSpec(parent=path_spec)
self._partition_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p1', parent=path_spec)
self._apfs_container_path_spec = (
apfs_container_path_spec.APFSContainerPathSpec(
location='/', parent=self._partition_path_spec))
def testGetStat(self):
"""Test the get stat functionality."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=1, parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
stat_object = file_entry.GetStat()
self.assertNotEqual(stat_object, None)
self.assertEqual(stat_object.type, stat_object.TYPE_FILE)
def _TestOpenClose(self, parent_path_spec):
"""Test the open and close functionality.
Args:
parent_path_spec: the parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=2, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 350 * self._BYTES_PER_SECTOR)
file_object.close()
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=13, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
with self.assertRaises(errors.PathSpecError):
file_object.open(path_spec=path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p2', parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR)
file_object.close()
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p0', parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
with self.assertRaises(errors.PathSpecError):
file_object.open(path_spec=path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p3', parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
with self.assertRaises(errors.PathSpecError):
file_object.open(path_spec=path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
start_offset=(352 * self._BYTES_PER_SECTOR), parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR)
file_object.close()
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
start_offset=(350 * self._BYTES_PER_SECTOR), parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
with self.assertRaises(errors.PathSpecError):
file_object.open(path_spec=path_spec)
def testGetParentFileEntry(self):
"""Test the get parent file entry functionality."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=1, parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
self.assertNotEqual(file_entry, None)
parent_file_entry = file_entry.GetParentFileEntry()
self.assertEqual(parent_file_entry, None)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
self._resolver_context = context.Context()
test_file = self._GetTestFilePath(['fvdetest.qcow2'])
path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = qcow_path_spec.QCOWPathSpec(parent=path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p1', parent=path_spec)
self._fvde_path_spec = fvde_path_spec.FVDEPathSpec(parent=path_spec)
resolver.Resolver.key_chain.SetCredential(
self._fvde_path_spec, 'password', self._FVDE_PASSWORD)
def testOpenCloseLocation(self):
"""Test the open and close functionality using a location."""
self._TestOpenCloseLocation(self._partition_path_spec)
# Try open with a path specification that has no parent.
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p1', parent=self._vhdi_path_spec)
path_spec.parent = None
with self.assertRaises(errors.PathSpecError):
self._TestOpenCloseLocation(path_spec)
def testGetStat(self):
"""Tests the GetStat function."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=1, parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
stat_object = file_entry.GetStat()
self.assertIsNotNone(stat_object)
self.assertEqual(stat_object.type, stat_object.TYPE_FILE)
self.assertEqual(stat_object.size, 512)
def testGetVolumeSystemTypeIndicatorsFVDE(self):
"""Tests the GetVolumeSystemTypeIndicators function on a FVDE volume."""
test_file = self._GetTestFilePath(['fvdetest.qcow2'])
path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = qcow_path_spec.QCOWPathSpec(parent=path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p1', parent=path_spec)
expected_type_indicators = [definitions.TYPE_INDICATOR_FVDE]
type_indicators = analyzer.Analyzer.GetVolumeSystemTypeIndicators(
path_spec)
self.assertEqual(type_indicators, expected_type_indicators)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
super(WindowsVersion2FixedVHDIFileTest, self).setUp()
test_file = self._GetTestFilePath(['ntfs-fixed.vhdx'])
self._SkipIfPathNotExists(test_file)
self._os_path_spec = os_path_spec.OSPathSpec(location=test_file)
self._vhdi_path_spec = vhdi_path_spec.VHDIPathSpec(
parent=self._os_path_spec)
self._partition_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p1', parent=self._vhdi_path_spec)
def testGetFileEntryByPathSpec(self):
"""Test the get entry by path specification functionality."""
file_system = tsk_partition_file_system.TSKPartitionFileSystem(
self._resolver_context)
self.assertNotEqual(file_system, None)
file_system.Open(path_spec=self._tsk_partition_path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/', parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertNotEqual(file_entry, None)
self.assertEqual(file_entry.name, u'')
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=3, parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertNotEqual(file_entry, None)
self.assertEqual(file_entry.name, u'')
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=6, parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertNotEqual(file_entry, None)
self.assertEqual(file_entry.name, u'p2')
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p2', parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertNotEqual(file_entry, None)
self.assertEqual(file_entry.name, u'p2')
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=9, parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertEqual(file_entry, None)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p0', parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertEqual(file_entry, None)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p9', parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertEqual(file_entry, None)
file_system.Close()
def testGetFileEntryByPathSpec(self):
"""Tests the GetFileEntryByPathSpec function."""
file_system = tsk_partition_file_system.TSKPartitionFileSystem(
self._resolver_context)
self.assertIsNotNone(file_system)
file_system.Open(self._tsk_partition_path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/', parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
self.assertEqual(file_entry.name, '')
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=3, parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
self.assertEqual(file_entry.name, '')
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=6, parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
self.assertEqual(file_entry.name, 'p2')
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p2', parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
self.assertEqual(file_entry.name, 'p2')
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=9, parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNone(file_entry)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p0', parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNone(file_entry)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p9', parent=self._os_path_spec)
file_entry = file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNone(file_entry)
file_system.Close()
def _TestSeek(self, parent_path_spec):
"""Test the seek functionality.
Args:
parent_path_spec (PathSpec): parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=6, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
file_object.Open()
self.assertEqual(file_object.get_size(), self._SIZE_P2)
file_object.seek(4128)
self.assertEqual(file_object.get_offset(), 0x11620 - self._OFFSET_P2)
self.assertEqual(file_object.read(16),
b'lost+found\x00\x00\x0c\x00\x00\x00')
self.assertEqual(file_object.get_offset(), 0x11630 - self._OFFSET_P2)
file_object.seek(-28156, os.SEEK_END)
self.assertEqual(file_object.get_offset(), 0x19a04 - self._OFFSET_P2)
data = file_object.read(8)
self.assertEqual(data, b' is a te')
self.assertEqual(file_object.get_offset(), 0x19a0c - self._OFFSET_P2)
file_object.seek(4, os.SEEK_CUR)
self.assertEqual(file_object.get_offset(), 0x19a10 - self._OFFSET_P2)
data = file_object.read(7)
self.assertEqual(data, b'ile.\n\nW')
self.assertEqual(file_object.get_offset(), 0x19a17 - self._OFFSET_P2)
# Conforming to the POSIX seek the offset can exceed the file size
# but reading will result in no data being returned.
expected_offset = self._SIZE_P2 + 100
file_object.seek(expected_offset, os.SEEK_SET)
self.assertEqual(file_object.get_offset(), expected_offset)
self.assertEqual(file_object.read(20), b'')
with self.assertRaises(IOError):
file_object.seek(-10, os.SEEK_SET)
# On error the offset should not change.
self.assertEqual(file_object.get_offset(), expected_offset)
with self.assertRaises(IOError):
file_object.seek(10, 5)
# On error the offset should not change.
self.assertEqual(file_object.get_offset(), expected_offset)
def _TestSeek(self, parent_path_spec):
"""Test the seek functionality.
Args:
parent_path_spec (PathSpec): parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=6, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context)
partition_offset = 352 * self._BYTES_PER_SECTOR
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR)
file_object.seek(0x7420)
self.assertEqual(file_object.get_offset(), 0x33420 - partition_offset)
self.assertEqual(file_object.read(16),
b'lost+found\x00\x00\x00\x00\x00\x00')
self.assertEqual(file_object.get_offset(), 0x33430 - partition_offset)
file_object.seek(-1251324, os.SEEK_END)
self.assertEqual(file_object.get_offset(), 0x36804 - partition_offset)
self.assertEqual(file_object.read(8),
b'\x03\x00\x00\x00\x04\x00\x00\x00')
self.assertEqual(file_object.get_offset(), 0x3680c - partition_offset)
file_object.seek(4, os.SEEK_CUR)
self.assertEqual(file_object.get_offset(), 0x36810 - partition_offset)
self.assertEqual(file_object.read(7), b'\x06\x00\x00\x00\x00\x00\x00')
self.assertEqual(file_object.get_offset(), 0x36817 - partition_offset)
# Conforming to the POSIX seek the offset can exceed the file size
# but reading will result in no data being returned.
expected_offset = (2528 * self._BYTES_PER_SECTOR) + 100
file_object.seek(expected_offset, os.SEEK_SET)
self.assertEqual(file_object.get_offset(), expected_offset)
self.assertEqual(file_object.read(20), b'')
with self.assertRaises(IOError):
file_object.seek(-10, os.SEEK_SET)
# On error the offset should not change.
self.assertEqual(file_object.get_offset(), expected_offset)
with self.assertRaises(IOError):
file_object.seek(10, 5)
# On error the offset should not change.
self.assertEqual(file_object.get_offset(), expected_offset)
file_object.close()
def setUp(self):
"""Sets up the needed objects used throughout the test."""
super(FVDEFileWithPathSpecCredentialsTest, self).setUp()
test_file = self._GetTestFilePath([u'fvdetest.qcow2'])
path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = qcow_path_spec.QCOWPathSpec(parent=path_spec)
self._tsk_partition_path_spec = (
tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p1', parent=path_spec))
self._fvde_path_spec = fvde_path_spec.FVDEPathSpec(
password=self._FVDE_PASSWORD, parent=self._tsk_partition_path_spec)
resolver.Resolver.key_chain.SetCredential(
self._fvde_path_spec, u'password', self._FVDE_PASSWORD)
def testGetDataStream(self):
"""Tests the GetDataStream function."""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=1, parent=self._os_path_spec)
file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
self.assertIsNotNone(file_entry)
data_stream_name = u''
data_stream = file_entry.GetDataStream(data_stream_name)
self.assertIsNotNone(data_stream)
self.assertEqual(data_stream.name, data_stream_name)
data_stream = file_entry.GetDataStream(u'bogus')
self.assertIsNone(data_stream)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
self._resolver_context = context.Context()
test_file = self._GetTestFilePath(['mbr.raw'])
self._SkipIfPathNotExists(test_file)
self._os_path_spec = os_path_spec.OSPathSpec(location=test_file)
self._tsk_partition_path_spec = (
tsk_partition_path_spec.TSKPartitionPathSpec(
location='/', parent=self._os_path_spec))
self._file_system = tsk_partition_file_system.TSKPartitionFileSystem(
self._resolver_context, self._tsk_partition_path_spec)
self._file_system.Open()
