def test_init(self): mft = MftTable(filename="sample_images/ntfs_mft_table.bin") entry = mft.get_entry(0) header = entry.header self.assertEquals(header.signature, "FILE") self.assertEquals(header.upd_seq_array_offset, 0x30) self.assertEquals(header.upd_seq_array_size, 0x3) self.assertEquals(header.logfile_seq_number, 0x104D82) self.assertEquals(header.seq_number, 0x1) self.assertEquals(header.hard_link_count, 0x1) self.assertEquals(header.first_attr_offset, 0x38) self.assertEquals(header.flags, 0x1) self.assertEquals(header.used_size, 0x1A0) self.assertEquals(header.allocated_size, 0x400) self.assertEquals(header.base_file_record, 0x0) self.assertEquals(header.next_attr_id, 0x0) self.assertEquals(header.mft_record_number, 0x0) self.assertEquals(len(entry.attributes), 4) self.assertEquals(entry.fname_str, "$MFT") self.assertEquals(entry.name_str, "Master File Table") self.assertFalse(entry.is_directory) self.assertTrue(entry.is_file) self.assertTrue(entry.is_in_use) self.assertTrue(entry.lookup_attribute(0x10) is not None)
def test_init(self): mft = MftTable(filename="sample_images/ntfs_mft_table.bin") self.assertEquals(len(mft._entries), 0) entry = mft.get_entry(0) self.assertTrue(entry is not None) self.assertEquals(len(mft._entries), 1)
def test_init(self): mft = MftTable(filename='sample_images/ntfs_mft_table.bin', ) entry = mft.get_entry(0) header = entry.header self.assertEqual(header.signature, b'FILE') self.assertEqual(header.upd_seq_array_offset, 0x30) self.assertEqual(header.upd_seq_array_size, 0x3) self.assertEqual(header.logfile_seq_number, 0x104D82) self.assertEqual(header.seq_number, 0x1) self.assertEqual(header.hard_link_count, 0x1) self.assertEqual(header.first_attr_offset, 0x38) self.assertEqual(header.flags, 0x1) self.assertEqual(header.used_size, 0x1A0) self.assertEqual(header.allocated_size, 0x400) self.assertEqual(header.base_file_record, 0x0) self.assertEqual(header.next_attr_id, 0x0) self.assertEqual(header.mft_record_number, 0x0) self.assertEqual(len(entry.attributes), 4) self.assertEqual(entry.fname_str, '$MFT') self.assertEqual(entry.name_str, 'Master File Table') self.assertFalse(entry.is_directory) self.assertTrue(entry.is_file) self.assertTrue(entry.is_in_use) self.assertTrue(entry.lookup_attribute(0x10) is not None)
def test_init(self): mft = MftTable(filename='sample_images/ntfs_mft_table.bin', ) self.assertEqual(len(mft._entries), 0) entry = mft.get_entry(0) self.assertTrue(entry is not None) self.assertEqual(len(mft._entries), 1)
def test_get_entry(self): mft = MftTable(filename="sample_images/ntfs_mft_table.bin") self.assertTrue(mft.get_entry(0) is not None) self.assertEquals(len(mft._entries), 1) self.assertTrue(mft.get_entry(3) is not None) self.assertTrue(mft.get_entry(2) is not None) self.assertEquals(len(mft._entries), 3)
def test_get_entry(self): mft = MftTable(filename='sample_images/ntfs_mft_table.bin', ) self.assertTrue(mft.get_entry(0) is not None) self.assertEqual(len(mft._entries), 1) self.assertTrue(mft.get_entry(3) is not None) self.assertTrue(mft.get_entry(2) is not None) self.assertEqual(len(mft._entries), 3)