コード例 #1
0
ファイル: ccleaner.py プロジェクト: tavernier/plaso
    def testProcessWithTimeZone(self):
        """Tests the Process function with a time zone."""
        plugin = ccleaner.CCleanerPlugin()
        test_file_entry = self._GetTestFileEntry(['NTUSER-CCLEANER.DAT'])
        key_path = 'HKEY_CURRENT_USER\\Software\\Piriform\\CCleaner'

        win_registry = self._GetWinRegistryFromFileEntry(test_file_entry)
        registry_key = win_registry.GetKeyByPath(key_path)
        storage_writer = self._ParseKeyWithPlugin(registry_key,
                                                  plugin,
                                                  file_entry=test_file_entry,
                                                  timezone='CET')

        self.assertEqual(storage_writer.number_of_warnings, 0)
        self.assertEqual(storage_writer.number_of_events, 2)

        events = list(storage_writer.GetEvents())

        expected_event_values = {
            'data_type': 'ccleaner:update',
            'key_path': key_path,
            # This should just be the plugin name, as we're invoking it directly,
            # and not through the parser.
            'parser': plugin.plugin_name,
            'timestamp': '2013-07-13 08:03:14.000000'
        }

        self.CheckEventValues(storage_writer, events[0], expected_event_values)
コード例 #2
0
  def testProcess(self):
    """Tests the Process function."""
    plugin = ccleaner.CCleanerPlugin()
    test_file_entry = self._GetTestFileEntry(['NTUSER-CCLEANER.DAT'])
    key_path = 'HKEY_CURRENT_USER\\Software\\Piriform\\CCleaner'

    win_registry = self._GetWinRegistryFromFileEntry(test_file_entry)
    registry_key = win_registry.GetKeyByPath(key_path)
    storage_writer = self._ParseKeyWithPlugin(
        registry_key, plugin, file_entry=test_file_entry)

    self.assertEqual(storage_writer.number_of_events, 2)

    events = list(storage_writer.GetEvents())

    event = events[0]

    self.assertEqual(event.pathspec, test_file_entry.path_spec)
    # This should just be the plugin name, as we're invoking it directly,
    # and not through the parser.
    self.assertEqual(event.parser, plugin.plugin_name)

    expected_timestamp = timelib.Timestamp.CopyFromString(
        '2013-07-13 10:03:14')
    self.assertEqual(event.timestamp, expected_timestamp)

    expected_message = 'Origin: {0:s}'.format(key_path)
    self._TestGetMessageStrings(event, expected_message, expected_message)

    event = events[1]

    expected_timestamp = timelib.Timestamp.CopyFromString(
        '2013-07-13 14:03:26.861688')
    self.assertEqual(event.timestamp, expected_timestamp)

    regvalue_identifier = '(App)Delete Index.dat files'
    expected_value = 'True'
    self._TestRegvalue(event, regvalue_identifier, expected_value)

    expected_message = (
        '[{0:s}] '
        '(App)Cookies: True '
        '(App)Delete Index.dat files: True '
        '(App)History: True '
        '(App)Last Download Location: True '
        '(App)Other Explorer MRUs: True '
        '(App)Recent Documents: True '
        '(App)Recently Typed URLs: True '
        '(App)Run (in Start Menu): True '
        '(App)Temporary Internet Files: True '
        '(App)Thumbnail Cache: True '
        'CookiesToSave: *.piriform.com '
        'WINDOW_HEIGHT: 524 '
        'WINDOW_LEFT: 146 '
        'WINDOW_MAX: 0 '
        'WINDOW_TOP: 102 '
        'WINDOW_WIDTH: 733').format(key_path)
    expected_short_message = '{0:s}...'.format(expected_message[:77])

    self._TestGetMessageStrings(event, expected_message, expected_short_message)
コード例 #3
0
    def testFilters(self):
        """Tests the FILTERS class attribute."""
        plugin = ccleaner.CCleanerPlugin()

        key_path = 'HKEY_CURRENT_USER\\Software\\Piriform\\CCleaner'
        self._AssertFiltersOnKeyPath(plugin, key_path)

        self._AssertNotFiltersOnKeyPath(plugin, 'HKEY_LOCAL_MACHINE\\Bogus')
コード例 #4
0
ファイル: ccleaner.py プロジェクト: dfjxs/plaso
    def testProcess(self):
        """Tests the Process function."""
        plugin = ccleaner.CCleanerPlugin()
        test_file_entry = self._GetTestFileEntry(['NTUSER-CCLEANER.DAT'])
        key_path = 'HKEY_CURRENT_USER\\Software\\Piriform\\CCleaner'

        win_registry = self._GetWinRegistryFromFileEntry(test_file_entry)
        registry_key = win_registry.GetKeyByPath(key_path)
        storage_writer = self._ParseKeyWithPlugin(registry_key,
                                                  plugin,
                                                  file_entry=test_file_entry)

        self.assertEqual(storage_writer.number_of_events, 2)
        self.assertEqual(storage_writer.number_of_extraction_warnings, 0)
        self.assertEqual(storage_writer.number_of_recovery_warnings, 0)

        events = list(storage_writer.GetEvents())

        expected_event_values = {
            'date_time': '2013-07-13 10:03:14',
            'data_type': 'ccleaner:update',
            'key_path': key_path,
            # This should just be the plugin name, as we're invoking it directly,
            # and not through the parser.
            'parser': plugin.NAME
        }

        self.CheckEventValues(storage_writer, events[0], expected_event_values)

        expected_configuration = ('(App)Cookies: True '
                                  '(App)Delete Index.dat files: True '
                                  '(App)History: True '
                                  '(App)Last Download Location: True '
                                  '(App)Other Explorer MRUs: True '
                                  '(App)Recent Documents: True '
                                  '(App)Recently Typed URLs: True '
                                  '(App)Run (in Start Menu): True '
                                  '(App)Temporary Internet Files: True '
                                  '(App)Thumbnail Cache: True '
                                  'CookiesToSave: *.piriform.com '
                                  'WINDOW_HEIGHT: 524 '
                                  'WINDOW_LEFT: 146 '
                                  'WINDOW_MAX: 0 '
                                  'WINDOW_TOP: 102 '
                                  'WINDOW_WIDTH: 733')

        expected_event_values = {
            'configuration': expected_configuration,
            'date_time': '2013-07-13 14:03:26.8616882',
            'data_type': 'ccleaner:configuration',
            'key_path': key_path
        }

        self.CheckEventValues(storage_writer, events[1], expected_event_values)
コード例 #5
0
ファイル: ccleaner.py プロジェクト: wankyou/plaso
    def testProcessWithTimeZone(self):
        """Tests the Process function with a time zone."""
        plugin = ccleaner.CCleanerPlugin()
        test_file_entry = self._GetTestFileEntry(['NTUSER-CCLEANER.DAT'])
        key_path = 'HKEY_CURRENT_USER\\Software\\Piriform\\CCleaner'

        win_registry = self._GetWinRegistryFromFileEntry(test_file_entry)
        registry_key = win_registry.GetKeyByPath(key_path)
        storage_writer = self._ParseKeyWithPlugin(registry_key,
                                                  plugin,
                                                  file_entry=test_file_entry,
                                                  timezone='CET')

        self.assertEqual(storage_writer.number_of_warnings, 0)
        self.assertEqual(storage_writer.number_of_events, 2)

        events = list(storage_writer.GetEvents())

        event = events[0]

        self.CheckTimestamp(event.timestamp, '2013-07-13 08:03:14.000000')
コード例 #6
0
ファイル: ccleaner_test.py プロジェクト: f-s-p/plaso
 def setUp(self):
     """Sets up the needed objects used throughout the test."""
     self._plugin = ccleaner.CCleanerPlugin()
コード例 #7
0
ファイル: ccleaner.py プロジェクト: vonnopsled/plaso
 def setUp(self):
     """Makes preparations before running an individual test."""
     self._plugin = ccleaner.CCleanerPlugin()