def testDataStreams(self): """Test the data streams functionality.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=1, parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) self.assertEqual(file_entry.number_of_data_streams, 1) data_stream_names = [] for data_stream in file_entry.data_streams: data_stream_names.append(data_stream.name) self.assertEqual(data_stream_names, [u'']) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/', parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) self.assertEqual(file_entry.number_of_data_streams, 0) data_stream_names = [] for data_stream in file_entry.data_streams: data_stream_names.append(data_stream.name) self.assertEqual(data_stream_names, [])
def testIsFunctions(self): """Test the Is? functions.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=1, parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) self.assertFalse(file_entry.IsRoot()) self.assertFalse(file_entry.IsVirtual()) self.assertFalse(file_entry.IsAllocated()) self.assertFalse(file_entry.IsDevice()) self.assertFalse(file_entry.IsDirectory()) self.assertTrue(file_entry.IsFile()) self.assertFalse(file_entry.IsLink()) self.assertFalse(file_entry.IsPipe()) self.assertFalse(file_entry.IsSocket()) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/', parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) self.assertTrue(file_entry.IsRoot()) self.assertTrue(file_entry.IsVirtual()) self.assertTrue(file_entry.IsAllocated()) self.assertFalse(file_entry.IsDevice()) self.assertTrue(file_entry.IsDirectory()) self.assertFalse(file_entry.IsFile()) self.assertFalse(file_entry.IsLink()) self.assertFalse(file_entry.IsPipe()) self.assertFalse(file_entry.IsSocket())
def testComparable(self): """Tests the path specification comparable property.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( parent=self._path_spec) self.assertNotEqual(path_spec, None) expected_comparable = u'\n'.join( [u'type: TEST', u'type: TSK_PARTITION', u'']) self.assertEqual(path_spec.comparable, expected_comparable) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p2', parent=self._path_spec) self.assertNotEqual(path_spec, None) expected_comparable = u'\n'.join( [u'type: TEST', u'type: TSK_PARTITION, location: /p2', u'']) self.assertEqual(path_spec.comparable, expected_comparable) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=1, parent=self._path_spec) self.assertNotEqual(path_spec, None) expected_comparable = u'\n'.join( [u'type: TEST', u'type: TSK_PARTITION, part index: 1', u'']) self.assertEqual(path_spec.comparable, expected_comparable) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( start_offset=0x2000, parent=self._path_spec) self.assertNotEqual(path_spec, None) expected_comparable = u'\n'.join([ u'type: TEST', u'type: TSK_PARTITION, start offset: 0x00002000', u'' ]) self.assertEqual(path_spec.comparable, expected_comparable) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p2', part_index=1, parent=self._path_spec) self.assertNotEqual(path_spec, None) expected_comparable = u'\n'.join([ u'type: TEST', u'type: TSK_PARTITION, location: /p2, part index: 1', u'' ]) self.assertEqual(path_spec.comparable, expected_comparable)
def setUp(self): """Sets up the needed objects used throughout the test.""" test_file = self._GetTestFilePath(['tsk_volume_system.raw']) path_spec = os_path_spec.OSPathSpec(location=test_file) self._tsk_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/', parent=path_spec)
def _TestRead(self, parent_path_spec): """Test the read functionality. Args: parent_path_spec (PathSpec): parent path specification. """ path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=6, parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile( self._resolver_context) partition_offset = 352 * self._BYTES_PER_SECTOR file_object.open(path_spec=path_spec) self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR) file_object.seek(0x2e900 - partition_offset) expected_data = ( b'\xc0\x41\x00\x00\x00\x30\x00\x00\xc8\x8c\xb9\x52\xc8\x8c\xb9\x52' b'\xc8\x8c\xb9\x52\x00\x00\x00\x00\x00\x00\x02\x00\x18\x00\x00\x00' ) self.assertEqual(file_object.read(32), expected_data) file_object.close()
def setUp(self): """Sets up the needed objects used throughout the test.""" test_file = os.path.join(u'test_data', u'tsk_volume_system.raw') path_spec = os_path_spec.OSPathSpec(location=test_file) self._tsk_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/', parent=path_spec)
def setUp(self): """Sets up the needed objects used throughout the test.""" test_file = self._GetTestFilePath(['mbr.raw']) self._SkipIfPathNotExists(test_file) path_spec = os_path_spec.OSPathSpec(location=test_file) self._tsk_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/', parent=path_spec)
def setUp(self): """Sets up the needed objects used throughout the test.""" self._resolver_context = context.Context() test_file = self._GetTestFilePath(['tsk_volume_system.raw']) self._os_path_spec = os_path_spec.OSPathSpec(location=test_file) self._tsk_partition_path_spec = ( tsk_partition_path_spec.TSKPartitionPathSpec( location='/', parent=self._os_path_spec))
def testSize(self): """Test the size property.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=2, parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) self.assertEqual(file_entry.size, 66048)
def setUp(self): """Sets up the needed objects used throughout the test.""" self._resolver_context = context.Context() test_file = os.path.join(u'test_data', u'tsk_volume_system.raw') self._os_path_spec = os_path_spec.OSPathSpec(location=test_file) self._tsk_partition_path_spec = ( tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/', parent=self._os_path_spec))
def testInitialize(self): """Tests the path specification initialization.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( parent=self._path_spec) self.assertNotEqual(path_spec, None) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p2', parent=self._path_spec) self.assertNotEqual(path_spec, None) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=1, parent=self._path_spec) self.assertNotEqual(path_spec, None) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( start_offset=0x2000, parent=self._path_spec) self.assertNotEqual(path_spec, None) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p2', part_index=1, parent=self._path_spec) self.assertNotEqual(path_spec, None) with self.assertRaises(ValueError): _ = tsk_partition_path_spec.TSKPartitionPathSpec(parent=None) with self.assertRaises(ValueError): _ = tsk_partition_path_spec.TSKPartitionPathSpec( parent=self._path_spec, bogus=u'BOGUS')
def GetRootFileEntry(self): """Retrieves the root file entry. Returns: TSKPartitionFileEntry: a file entry or None of not available. """ path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=self.LOCATION_ROOT, parent=self._path_spec.parent) return self.GetFileEntryByPathSpec(path_spec)
def GetRootFileEntry(self): """Retrieves the root file entry. Returns: A file entry (instance of vfs.FileEntry). """ path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=self.LOCATION_ROOT, parent=self._path_spec.parent) return self.GetFileEntryByPathSpec(path_spec)
def testGetParentFileEntry(self): """Tests the GetParentFileEntry function.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=1, parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) parent_file_entry = file_entry.GetParentFileEntry() self.assertIsNone(parent_file_entry)
def setUp(self): """Sets up the needed objects used throughout the test.""" test_file = self._GetTestFilePath(['apfs.dmg']) path_spec = os_path_spec.OSPathSpec(location=test_file) path_spec = raw_path_spec.RawPathSpec(parent=path_spec) self._partition_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/p1', parent=path_spec) self._apfs_container_path_spec = ( apfs_container_path_spec.APFSContainerPathSpec( location='/', parent=self._partition_path_spec))
def testGetStat(self): """Test the get stat functionality.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=1, parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) stat_object = file_entry.GetStat() self.assertNotEqual(stat_object, None) self.assertEqual(stat_object.type, stat_object.TYPE_FILE)
def _TestOpenClose(self, parent_path_spec): """Test the open and close functionality. Args: parent_path_spec: the parent path specification. """ path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=2, parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context) file_object.open(path_spec=path_spec) self.assertEqual(file_object.get_size(), 350 * self._BYTES_PER_SECTOR) file_object.close() path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=13, parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context) with self.assertRaises(errors.PathSpecError): file_object.open(path_spec=path_spec) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p2', parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context) file_object.open(path_spec=path_spec) self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR) file_object.close() path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p0', parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context) with self.assertRaises(errors.PathSpecError): file_object.open(path_spec=path_spec) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p3', parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context) with self.assertRaises(errors.PathSpecError): file_object.open(path_spec=path_spec) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( start_offset=(352 * self._BYTES_PER_SECTOR), parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context) file_object.open(path_spec=path_spec) self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR) file_object.close() path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( start_offset=(350 * self._BYTES_PER_SECTOR), parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context) with self.assertRaises(errors.PathSpecError): file_object.open(path_spec=path_spec)
def testGetParentFileEntry(self): """Test the get parent file entry functionality.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=1, parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) self.assertNotEqual(file_entry, None) parent_file_entry = file_entry.GetParentFileEntry() self.assertEqual(parent_file_entry, None)
def setUp(self): """Sets up the needed objects used throughout the test.""" self._resolver_context = context.Context() test_file = self._GetTestFilePath(['fvdetest.qcow2']) path_spec = os_path_spec.OSPathSpec(location=test_file) path_spec = qcow_path_spec.QCOWPathSpec(parent=path_spec) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/p1', parent=path_spec) self._fvde_path_spec = fvde_path_spec.FVDEPathSpec(parent=path_spec) resolver.Resolver.key_chain.SetCredential( self._fvde_path_spec, 'password', self._FVDE_PASSWORD)
def testOpenCloseLocation(self): """Test the open and close functionality using a location.""" self._TestOpenCloseLocation(self._partition_path_spec) # Try open with a path specification that has no parent. path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/p1', parent=self._vhdi_path_spec) path_spec.parent = None with self.assertRaises(errors.PathSpecError): self._TestOpenCloseLocation(path_spec)
def testGetStat(self): """Tests the GetStat function.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=1, parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) stat_object = file_entry.GetStat() self.assertIsNotNone(stat_object) self.assertEqual(stat_object.type, stat_object.TYPE_FILE) self.assertEqual(stat_object.size, 512)
def testGetVolumeSystemTypeIndicatorsFVDE(self): """Tests the GetVolumeSystemTypeIndicators function on a FVDE volume.""" test_file = self._GetTestFilePath(['fvdetest.qcow2']) path_spec = os_path_spec.OSPathSpec(location=test_file) path_spec = qcow_path_spec.QCOWPathSpec(parent=path_spec) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/p1', parent=path_spec) expected_type_indicators = [definitions.TYPE_INDICATOR_FVDE] type_indicators = analyzer.Analyzer.GetVolumeSystemTypeIndicators( path_spec) self.assertEqual(type_indicators, expected_type_indicators)
def setUp(self): """Sets up the needed objects used throughout the test.""" super(WindowsVersion2FixedVHDIFileTest, self).setUp() test_file = self._GetTestFilePath(['ntfs-fixed.vhdx']) self._SkipIfPathNotExists(test_file) self._os_path_spec = os_path_spec.OSPathSpec(location=test_file) self._vhdi_path_spec = vhdi_path_spec.VHDIPathSpec( parent=self._os_path_spec) self._partition_path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/p1', parent=self._vhdi_path_spec)
def testGetFileEntryByPathSpec(self): """Test the get entry by path specification functionality.""" file_system = tsk_partition_file_system.TSKPartitionFileSystem( self._resolver_context) self.assertNotEqual(file_system, None) file_system.Open(path_spec=self._tsk_partition_path_spec) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/', parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertNotEqual(file_entry, None) self.assertEqual(file_entry.name, u'') path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=3, parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertNotEqual(file_entry, None) self.assertEqual(file_entry.name, u'') path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=6, parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertNotEqual(file_entry, None) self.assertEqual(file_entry.name, u'p2') path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p2', parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertNotEqual(file_entry, None) self.assertEqual(file_entry.name, u'p2') path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=9, parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertEqual(file_entry, None) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p0', parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertEqual(file_entry, None) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p9', parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertEqual(file_entry, None) file_system.Close()
def testGetFileEntryByPathSpec(self): """Tests the GetFileEntryByPathSpec function.""" file_system = tsk_partition_file_system.TSKPartitionFileSystem( self._resolver_context) self.assertIsNotNone(file_system) file_system.Open(self._tsk_partition_path_spec) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/', parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) self.assertEqual(file_entry.name, '') path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=3, parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) self.assertEqual(file_entry.name, '') path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=6, parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) self.assertEqual(file_entry.name, 'p2') path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/p2', parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) self.assertEqual(file_entry.name, 'p2') path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=9, parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNone(file_entry) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/p0', parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNone(file_entry) path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( location='/p9', parent=self._os_path_spec) file_entry = file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNone(file_entry) file_system.Close()
def _TestSeek(self, parent_path_spec): """Test the seek functionality. Args: parent_path_spec (PathSpec): parent path specification. """ path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=6, parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile( self._resolver_context, path_spec) file_object.Open() self.assertEqual(file_object.get_size(), self._SIZE_P2) file_object.seek(4128) self.assertEqual(file_object.get_offset(), 0x11620 - self._OFFSET_P2) self.assertEqual(file_object.read(16), b'lost+found\x00\x00\x0c\x00\x00\x00') self.assertEqual(file_object.get_offset(), 0x11630 - self._OFFSET_P2) file_object.seek(-28156, os.SEEK_END) self.assertEqual(file_object.get_offset(), 0x19a04 - self._OFFSET_P2) data = file_object.read(8) self.assertEqual(data, b' is a te') self.assertEqual(file_object.get_offset(), 0x19a0c - self._OFFSET_P2) file_object.seek(4, os.SEEK_CUR) self.assertEqual(file_object.get_offset(), 0x19a10 - self._OFFSET_P2) data = file_object.read(7) self.assertEqual(data, b'ile.\n\nW') self.assertEqual(file_object.get_offset(), 0x19a17 - self._OFFSET_P2) # Conforming to the POSIX seek the offset can exceed the file size # but reading will result in no data being returned. expected_offset = self._SIZE_P2 + 100 file_object.seek(expected_offset, os.SEEK_SET) self.assertEqual(file_object.get_offset(), expected_offset) self.assertEqual(file_object.read(20), b'') with self.assertRaises(IOError): file_object.seek(-10, os.SEEK_SET) # On error the offset should not change. self.assertEqual(file_object.get_offset(), expected_offset) with self.assertRaises(IOError): file_object.seek(10, 5) # On error the offset should not change. self.assertEqual(file_object.get_offset(), expected_offset)
def _TestSeek(self, parent_path_spec): """Test the seek functionality. Args: parent_path_spec (PathSpec): parent path specification. """ path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=6, parent=parent_path_spec) file_object = tsk_partition_file_io.TSKPartitionFile( self._resolver_context) partition_offset = 352 * self._BYTES_PER_SECTOR file_object.open(path_spec=path_spec) self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR) file_object.seek(0x7420) self.assertEqual(file_object.get_offset(), 0x33420 - partition_offset) self.assertEqual(file_object.read(16), b'lost+found\x00\x00\x00\x00\x00\x00') self.assertEqual(file_object.get_offset(), 0x33430 - partition_offset) file_object.seek(-1251324, os.SEEK_END) self.assertEqual(file_object.get_offset(), 0x36804 - partition_offset) self.assertEqual(file_object.read(8), b'\x03\x00\x00\x00\x04\x00\x00\x00') self.assertEqual(file_object.get_offset(), 0x3680c - partition_offset) file_object.seek(4, os.SEEK_CUR) self.assertEqual(file_object.get_offset(), 0x36810 - partition_offset) self.assertEqual(file_object.read(7), b'\x06\x00\x00\x00\x00\x00\x00') self.assertEqual(file_object.get_offset(), 0x36817 - partition_offset) # Conforming to the POSIX seek the offset can exceed the file size # but reading will result in no data being returned. expected_offset = (2528 * self._BYTES_PER_SECTOR) + 100 file_object.seek(expected_offset, os.SEEK_SET) self.assertEqual(file_object.get_offset(), expected_offset) self.assertEqual(file_object.read(20), b'') with self.assertRaises(IOError): file_object.seek(-10, os.SEEK_SET) # On error the offset should not change. self.assertEqual(file_object.get_offset(), expected_offset) with self.assertRaises(IOError): file_object.seek(10, 5) # On error the offset should not change. self.assertEqual(file_object.get_offset(), expected_offset) file_object.close()
def setUp(self): """Sets up the needed objects used throughout the test.""" super(FVDEFileWithPathSpecCredentialsTest, self).setUp() test_file = self._GetTestFilePath([u'fvdetest.qcow2']) path_spec = os_path_spec.OSPathSpec(location=test_file) path_spec = qcow_path_spec.QCOWPathSpec(parent=path_spec) self._tsk_partition_path_spec = ( tsk_partition_path_spec.TSKPartitionPathSpec( location=u'/p1', parent=path_spec)) self._fvde_path_spec = fvde_path_spec.FVDEPathSpec( password=self._FVDE_PASSWORD, parent=self._tsk_partition_path_spec) resolver.Resolver.key_chain.SetCredential( self._fvde_path_spec, u'password', self._FVDE_PASSWORD)
def testGetDataStream(self): """Tests the GetDataStream function.""" path_spec = tsk_partition_path_spec.TSKPartitionPathSpec( part_index=1, parent=self._os_path_spec) file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) self.assertIsNotNone(file_entry) data_stream_name = u'' data_stream = file_entry.GetDataStream(data_stream_name) self.assertIsNotNone(data_stream) self.assertEqual(data_stream.name, data_stream_name) data_stream = file_entry.GetDataStream(u'bogus') self.assertIsNone(data_stream)
def setUp(self): """Sets up the needed objects used throughout the test.""" self._resolver_context = context.Context() test_file = self._GetTestFilePath(['mbr.raw']) self._SkipIfPathNotExists(test_file) self._os_path_spec = os_path_spec.OSPathSpec(location=test_file) self._tsk_partition_path_spec = ( tsk_partition_path_spec.TSKPartitionPathSpec( location='/', parent=self._os_path_spec)) self._file_system = tsk_partition_file_system.TSKPartitionFileSystem( self._resolver_context, self._tsk_partition_path_spec) self._file_system.Open()