def testParse(self): """Tests the Parse function.""" parser = olecf.OLECFParser() storage_writer = self._ParseFile(['Document.doc'], parser) # OLE Compound File information: # Version : 3.62 # Sector size : 512 # Short sector size : 64 number_of_events = storage_writer.GetNumberOfAttributeContainers( 'event') self.assertEqual(number_of_events, 9) number_of_warnings = storage_writer.GetNumberOfAttributeContainers( 'extraction_warning') self.assertEqual(number_of_warnings, 0) number_of_warnings = storage_writer.GetNumberOfAttributeContainers( 'recovery_warning') self.assertEqual(number_of_warnings, 0) events = list(storage_writer.GetEvents()) expected_event_values = { 'data_type': 'olecf:item', 'date_time': '2013-05-16 02:29:49.7850000', 'timestamp_desc': definitions.TIME_DESCRIPTION_MODIFICATION } self.CheckEventValues(storage_writer, events[8], expected_event_values) storage_writer = self._CreateStorageWriter() parser_mediator = self._CreateParserMediator(storage_writer) parser = olecf.OLECFParser() parser.ParseFileObject(parser_mediator, None) number_of_events = storage_writer.GetNumberOfAttributeContainers( 'event') self.assertEqual(number_of_events, 0) number_of_warnings = storage_writer.GetNumberOfAttributeContainers( 'extraction_warning') self.assertEqual(number_of_warnings, 1) number_of_warnings = storage_writer.GetNumberOfAttributeContainers( 'recovery_warning') self.assertEqual(number_of_warnings, 0) generator = storage_writer.GetAttributeContainers( warnings.ExtractionWarning.CONTAINER_TYPE) test_warnings = list(generator) test_warning = test_warnings[0] self.assertIsNotNone(test_warning) expected_message = ( 'unable to open file with error: pyolecf_file_open_file_object: ') self.assertTrue(test_warning.message.startswith(expected_message))
def testParse(self): """Tests the Parse function.""" parser = olecf.OLECFParser() storage_writer = self._ParseFile(['Document.doc'], parser) # OLE Compound File information: # Version : 3.62 # Sector size : 512 # Short sector size : 64 self.assertEqual(storage_writer.number_of_events, 9) self.assertEqual(storage_writer.number_of_errors, 0) events = list(storage_writer.GetEvents()) event = events[8] expected_timestamp = timelib.Timestamp.CopyFromString( '2013-05-16 02:29:49.785') self.assertEqual(event.timestamp, expected_timestamp) self.assertEqual(event.timestamp_desc, definitions.TIME_DESCRIPTION_MODIFICATION) self.assertEqual(event.data_type, 'olecf:item') self.assertEqual(event.offset, 0) storage_writer = self._CreateStorageWriter() parser_mediator = self._CreateParserMediator(storage_writer) parser = olecf.OLECFParser() parser.ParseFileObject(parser_mediator, None) self.assertEqual(storage_writer.number_of_events, 0) self.assertEqual(storage_writer.number_of_errors, 1) errors = list(storage_writer.GetErrors()) error = errors[0] self.assertIsNotNone(error) self.assertTrue( error.message.startswith( 'unable to open file with error: pyolecf_file_open_file_object: ' ))
def testParse(self): """Tests the Parse function.""" parser = olecf.OLECFParser() storage_writer = self._ParseFile(['Document.doc'], parser) # OLE Compound File information: # Version : 3.62 # Sector size : 512 # Short sector size : 64 self.assertEqual(storage_writer.number_of_warnings, 0) self.assertEqual(storage_writer.number_of_events, 9) events = list(storage_writer.GetEvents()) event = events[8] self.CheckTimestamp(event.timestamp, '2013-05-16 02:29:49.785000') self.assertEqual(event.timestamp_desc, definitions.TIME_DESCRIPTION_MODIFICATION) event_data = self._GetEventDataOfEvent(storage_writer, event) self.assertEqual(event_data.data_type, 'olecf:item') self.assertEqual(event_data.offset, 0) storage_writer = self._CreateStorageWriter() parser_mediator = self._CreateParserMediator(storage_writer) parser = olecf.OLECFParser() parser.ParseFileObject(parser_mediator, None) self.assertEqual(storage_writer.number_of_warnings, 1) self.assertEqual(storage_writer.number_of_events, 0) warnings = list(storage_writer.GetWarnings()) warning = warnings[0] self.assertIsNotNone(warning) self.assertTrue( warning.message.startswith( 'unable to open file with error: pyolecf_file_open_file_object: ' ))
def testParse(self): """Tests the Parse function.""" parser_object = olecf.OLECFParser() storage_writer = self._ParseFile([u'Document.doc'], parser_object) # OLE Compound File information: # Version : 3.62 # Sector size : 512 # Short sector size : 64 self.assertEqual(len(storage_writer.events), 9) self.assertEqual(len(storage_writer.errors), 0) event_object = storage_writer.events[8] self.assertEqual(event_object.data_type, u'olecf:item') self.assertEqual(event_object.offset, 0) expected_timestamp = timelib.Timestamp.CopyFromString( u'2013-05-16 02:29:49.785') self.assertEqual(event_object.timestamp, expected_timestamp) self.assertEqual( event_object.timestamp_desc, eventdata.EventTimestamp.MODIFICATION_TIME) storage_writer = self._CreateStorageWriter() parser_mediator = self._CreateParserMediator(storage_writer) parser_object = olecf.OLECFParser() parser_object.ParseFileObject(parser_mediator, None) self.assertEqual(len(storage_writer.events), 0) self.assertEqual(len(storage_writer.errors), 1) error = storage_writer.errors[0] self.assertIsNotNone(error) self.assertTrue(error.message.startswith( u'unable to open file with error: pyolecf_file_open_file_object: '))
def testEnablePlugins(self): """Tests the EnablePlugins function.""" parser = olecf.OLECFParser() number_of_plugins = len(parser._plugin_classes) parser.EnablePlugins([]) self.assertEqual(len(parser._plugins), 0) parser.EnablePlugins(parser.ALL_PLUGINS) # Extract 1 for the default plugin. self.assertEqual(len(parser._plugins), number_of_plugins - 1) parser.EnablePlugins(['olecf_document_summary']) self.assertEqual(len(parser._plugins), 1)