def testGlobRawVMDKExtension(self): """Test the glob function for a RAW VMDK extension scheme.""" segment_filenames = ['image-f001.vmdk'] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) # Test single segment file: 001. path_spec = fake_path_spec.FakePathSpec(location='/image-f001.vmdk') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test non exiting segment file: 001. expected_segment_file_path_specs = [] path_spec = fake_path_spec.FakePathSpec(location='/bogus-f000.vmdk') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: 001-010. segment_filenames = [ 'image-f001.vmdk', 'image-f002.vmdk', 'image-f003.vmdk', 'image-f004.vmdk', 'image-f005.vmdk', 'image-f006.vmdk', 'image-f007.vmdk', 'image-f008.vmdk', 'image-f009.vmdk', 'image-f010.vmdk' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/image-f001.vmdk') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs)
def testGlobRawAsbExtension(self): """Test the glob function for a RAW ASB extension scheme.""" segment_filenames = [u'image001.asb'] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) # Test single segment file: 001. path_spec = fake_path_spec.FakePathSpec(location=u'/image001.asb') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test non exiting segment file: 001. expected_segment_file_path_specs = [] path_spec = fake_path_spec.FakePathSpec(location=u'/bogus000.asb') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: 001-010. segment_filenames = [ u'image001.asb', u'image002.asb', u'image003.asb', u'image004.asb', u'image005.asb', u'image006.asb', u'image007.asb', u'image008.asb', u'image009.asb', u'image010.asb' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location=u'/image001.asb') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs)
def ScanForStorageMediaImage(self, source_path_spec): """Scans the path specification for a supported storage media image format. Args: source_path_spec (PathSpec): source path specification. Returns: PathSpec: storage media image path specification or None if no supported storage media image type was found. Raises: BackEndError: if the source cannot be scanned or more than one storage media image type is found. """ try: type_indicators = analyzer.Analyzer.GetStorageMediaImageTypeIndicators( source_path_spec, resolver_context=self._resolver_context) except RuntimeError as exception: raise errors.BackEndError( ('Unable to process source path specification with error: ' '{0!s}').format(exception)) if not type_indicators: # The RAW storage media image type cannot be detected based on # a signature so we try to detect it based on common file naming schemas. file_system = resolver.Resolver.OpenFileSystem( source_path_spec, resolver_context=self._resolver_context) raw_path_spec = path_spec_factory.Factory.NewPathSpec( definitions.TYPE_INDICATOR_RAW, parent=source_path_spec) try: # The RAW glob function will raise a PathSpecError if the path # specification is unsuitable for globbing. glob_results = raw.RawGlobPathSpec(file_system, raw_path_spec) except errors.PathSpecError: glob_results = None file_system.Close() if not glob_results: return None return raw_path_spec if len(type_indicators) > 1: raise errors.BackEndError( 'Unsupported source found more than one storage media image types.' ) return path_spec_factory.Factory.NewPathSpec(type_indicators[0], parent=source_path_spec)
def _OpenFileObject(self, path_spec): """Opens the file-like object defined by path specification. Args: path_spec: the path specification (instance of path.PathSpec). Returns: A file-like object or None. Raises: PathSpecError: if the path specification is invalid. """ if not path_spec.HasParent(): raise errors.PathSpecError( u'Unsupported path specification without parent.') parent_path_spec = path_spec.parent file_system = resolver.Resolver.OpenFileSystem( parent_path_spec, resolver_context=self._resolver_context) # Note that we cannot use pysmraw's glob function since it does not # handle the file system abstraction dfvfs provides. segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) if not segment_file_path_specs: return if parent_path_spec.IsSystemLevel(): # Typically the file-like object cache should have room for 127 items. self._resolver_context.SetMaximumNumberOfFileObjects( len(segment_file_path_specs) + 127) file_objects = [] for segment_file_path_spec in segment_file_path_specs: file_object = resolver.Resolver.OpenFileObject( segment_file_path_spec, resolver_context=self._resolver_context) file_objects.append(file_object) raw_handle = pysmraw.handle() raw_handle.open_file_objects(file_objects) return raw_handle
def testGlobRawSinglecExtension(self): """Test the glob function for a RAW single extension scheme.""" # Test single segment file: dd. segment_filenames = ['ímynd.dd'] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/ímynd.dd') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test single segment file: dmg. segment_filenames = ['image.dmg'] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/image.dmg') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test single segment file: img. segment_filenames = ['image.img'] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/image.img') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test single segment file: raw. segment_filenames = ['image.raw'] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/image.raw') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs)
def testGlobRawNumericSuffix(self): """Test the glob function for a RAW numeric suffix scheme.""" segment_filenames = ['image1'] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) # Test single segment file: 000. path_spec = fake_path_spec.FakePathSpec(location='/image1') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test non exiting segment file: 000. expected_segment_file_path_specs = [] path_spec = fake_path_spec.FakePathSpec(location='/bogus1') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: 000-010. segment_filenames = [ 'image0', 'image1', 'image2', 'image3', 'image4', 'image5', 'image6', 'image7', 'image8', 'image9', 'image10' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/image0') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: 1-10. segment_filenames = [ 'image1', 'image2', 'image3', 'image4', 'image5', 'image6', 'image7', 'image8', 'image9', 'image10' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/image1') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: 001-010. segment_filenames = [ 'image001', 'image002', 'image003', 'image004', 'image005', 'image006', 'image007', 'image008', 'image009', 'image010' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/image001') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs)
def testGlobRawAlphabeticalSuffix(self): """Test the glob function for a RAW alphabetical suffix scheme.""" segment_filenames = ['imageaaa'] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) # Test single segment file: aaa. path_spec = fake_path_spec.FakePathSpec(location='/imageaaa') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test non exiting segment file: aaa. expected_segment_file_path_specs = [] path_spec = fake_path_spec.FakePathSpec(location='/bogusaaa') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: aaa-aak. segment_filenames = [ 'imageaaa', 'imageaab', 'imageaac', 'imageaad', 'imageaae', 'imageaaf', 'imageaag', 'imageaah', 'imageaai', 'imageaaj', 'imageaak' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/imageaaa') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: AAA-AAk. segment_filenames = [ 'imageAAA', 'imageAAB', 'imageAAC', 'imageAAD', 'imageAAE', 'imageAAF', 'imageAAG', 'imageAAH', 'imageAAI', 'imageAAJ', 'imageAAK' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location='/imageAAA') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs)
def GetBasePathSpec(self, source_path): """Determines the base path specification. Args: source_path: the source path. Returns: The base path specification (instance of dfvfs.PathSpec). Raises: RuntimeError: if the source path does not exists, or if the source path is not a file or directory, or if the format of or within the source file is not supported. """ if not os.path.exists(source_path): raise RuntimeError(u'No such source: {0:s}.'.format(source_path)) stat_info = os.stat(source_path) if (not stat.S_ISDIR(stat_info.st_mode) and not stat.S_ISREG(stat_info.st_mode)): raise RuntimeError( u'Unsupported source: {0:s} not a file or directory.'.format( source_path)) if stat.S_ISDIR(stat_info.st_mode): path_spec = path_spec_factory.Factory.NewPathSpec( definitions.TYPE_INDICATOR_OS, location=source_path) elif stat.S_ISREG(stat_info.st_mode): path_spec = path_spec_factory.Factory.NewPathSpec( definitions.TYPE_INDICATOR_OS, location=source_path) type_indicators = analyzer.Analyzer.GetStorageMediaImageTypeIndicators( path_spec) if len(type_indicators) > 1: raise RuntimeError(( u'Unsupported source: {0:s} found more than one storage media ' u'image types.').format(source_path)) if len(type_indicators) == 1: path_spec = path_spec_factory.Factory.NewPathSpec( type_indicators[0], parent=path_spec) if not type_indicators: # The RAW storage media image type cannot be detected based on # a signature so we try to detect it based on common file naming # schemas. file_system = resolver.Resolver.OpenFileSystem(path_spec) raw_path_spec = path_spec_factory.Factory.NewPathSpec( definitions.TYPE_INDICATOR_RAW, parent=path_spec) glob_results = raw.RawGlobPathSpec(file_system, raw_path_spec) if glob_results: path_spec = raw_path_spec # In case we did not find a storage media image type we keep looking # since not all RAW storage media image naming schemas are known and # its type can only detected by its content. path_spec = self._GetUpperLevelVolumeSystemPathSpec(path_spec) # In case we did not find a volume system type we keep looking # since we could be dealing with a store media image that contains # a single volume. type_indicators = analyzer.Analyzer.GetFileSystemTypeIndicators( path_spec) if len(type_indicators) > 1: raise RuntimeError(( u'Unsupported source: {0:s} found more than one file system ' u'types.').format(source_path)) if not type_indicators: logging.warning(u'Unable to find a supported file system.') path_spec = path_spec_factory.Factory.NewPathSpec( definitions.TYPE_INDICATOR_OS, location=source_path) elif type_indicators[0] != definitions.TYPE_INDICATOR_TSK: raise RuntimeError(( u'Unsupported source: {0:s} found unsupported file system ' u'type: {1:s}.').format(source_path, type_indicators[0])) else: path_spec = path_spec_factory.Factory.NewPathSpec( definitions.TYPE_INDICATOR_TSK, location=u'/', parent=path_spec) return path_spec
(u'Unsupported source: {0:s} found more than one storage media ' u'image types.').format(source_path)) if len(type_indicators) == 1: path_spec = path_spec_factory.Factory.NewPathSpec(type_indicators[0], parent=path_spec) if not type_indicators: # The RAW storage media image type cannot be detected based on # a signature so we try to detect it based on common file naming # schemas. file_system = resolver.Resolver.OpenFileSystem(path_spec) raw_path_spec = path_spec_factory.Factory.NewPathSpec( definitions.TYPE_INDICATOR_RAW, parent=path_spec) glob_results = raw.RawGlobPathSpec(file_system, raw_path_spec) if glob_results: path_spec = raw_path_spec volume_system_path_spec = path_spec_factory.Factory.NewPathSpec( definitions.TYPE_INDICATOR_TSK_PARTITION, location=u'/', parent=path_spec) volume_system = tsk_volume_system.TSKVolumeSystem() volume_system.Open(volume_system_path_spec) volume_identifiers = [] for volume in volume_system.volumes: volume_identifier = getattr(volume, 'identifier', None) if volume_identifier: volume_identifiers.append(volume_identifier)
def testGlobRawNumericExtension(self): """Test the glob function for a RAW numeric extension scheme.""" segment_filenames = [u'image.000'] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) # Test single segment file: 000. path_spec = fake_path_spec.FakePathSpec(location=u'/image.000') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test non exiting segment file: 000. expected_segment_file_path_specs = [] path_spec = fake_path_spec.FakePathSpec(location=u'/bogus.000') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: 000-010. segment_filenames = [ u'image.000', u'image.001', u'image.002', u'image.003', u'image.004', u'image.005', u'image.006', u'image.007', u'image.008', u'image.009', u'image.010' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location=u'/image.000') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: 001-010. segment_filenames = [ u'image.001', u'image.002', u'image.003', u'image.004', u'image.005', u'image.006', u'image.007', u'image.008', u'image.009', u'image.010' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location=u'/image.001') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs) # Test multiple segment files: 1-10. segment_filenames = [ u'image.1', u'image.2', u'image.3', u'image.4', u'image.5', u'image.6', u'image.7', u'image.8', u'image.9', u'image.10' ] expected_segment_file_path_specs = [] file_system = self._BuildFileFakeFileSystem( segment_filenames, expected_segment_file_path_specs) path_spec = fake_path_spec.FakePathSpec(location=u'/image.1') path_spec = raw_path_spec.RawPathSpec(parent=path_spec) segment_file_path_specs = raw.RawGlobPathSpec(file_system, path_spec) self.assertEqual(len(segment_file_path_specs), len(expected_segment_file_path_specs)) self.assertEqual(segment_file_path_specs, expected_segment_file_path_specs)