def testGetPlasoTimestamp(self):
"""Tests the GetPlasoTimestamp function."""
uuid_object = uuid.UUID(u'00911b54-9ef4-11e1-be53-525400123456')
uuid_time_object = uuid_time.UUIDTime(timestamp=uuid_object.time)
expected_micro_posix_timestamp = 1337130661654408
micro_posix_timestamp = uuid_time_object.GetPlasoTimestamp()
self.assertEqual(micro_posix_timestamp, expected_micro_posix_timestamp)
uuid_time_object = uuid_time.UUIDTime()
uuid_time_object.timestamp = 0x1fffffffffffffff
micro_posix_timestamp = uuid_time_object.GetPlasoTimestamp()
self.assertIsNone(micro_posix_timestamp)
uuid_time_object = uuid_time.UUIDTime()
uuid_time_object.timestamp = -1
micro_posix_timestamp = uuid_time_object.GetPlasoTimestamp()
self.assertIsNone(micro_posix_timestamp)
uuid_time_object = uuid_time.UUIDTime()
micro_posix_timestamp = uuid_time_object.GetPlasoTimestamp()
self.assertIsNone(micro_posix_timestamp)
def testGetNormalizedTimestamp(self):
"""Tests the _GetNormalizedTimestamp function."""
uuid_object = uuid.UUID('00911b54-9ef4-11e1-be53-525400123456')
uuid_time_object = uuid_time.UUIDTime(timestamp=uuid_object.time)
normalized_timestamp = uuid_time_object._GetNormalizedTimestamp()
self.assertEqual(
normalized_timestamp, decimal.Decimal('1337130661.6544084'))
uuid_time_object = uuid_time.UUIDTime()
uuid_time_object._timestamp = 0x1fffffffffffffff
normalized_timestamp = uuid_time_object._GetNormalizedTimestamp()
self.assertIsNone(normalized_timestamp)
uuid_time_object = uuid_time.UUIDTime()
uuid_time_object._timestamp = -1
normalized_timestamp = uuid_time_object._GetNormalizedTimestamp()
self.assertIsNone(normalized_timestamp)
uuid_time_object = uuid_time.UUIDTime()
normalized_timestamp = uuid_time_object._GetNormalizedTimestamp()
self.assertIsNone(normalized_timestamp)
def testCopyToStatTimeTuple(self):
"""Tests the CopyToStatTimeTuple function."""
uuid_object = uuid.UUID(u'00911b54-9ef4-11e1-be53-525400123456')
uuid_time_object = uuid_time.UUIDTime(timestamp=uuid_object.time)
expected_stat_time_tuple = (1337130661, 6544084)
stat_time_tuple = uuid_time_object.CopyToStatTimeTuple()
self.assertEqual(stat_time_tuple, expected_stat_time_tuple)
uuid_time_object = uuid_time.UUIDTime()
uuid_time_object.timestamp = 0x1fffffffffffffff
expected_stat_time_tuple = (None, None)
stat_time_tuple = uuid_time_object.CopyToStatTimeTuple()
self.assertEqual(stat_time_tuple, expected_stat_time_tuple)
uuid_time_object = uuid_time.UUIDTime()
uuid_time_object.timestamp = -1
expected_stat_time_tuple = (None, None)
stat_time_tuple = uuid_time_object.CopyToStatTimeTuple()
self.assertEqual(stat_time_tuple, expected_stat_time_tuple)
uuid_time_object = uuid_time.UUIDTime()
expected_stat_time_tuple = (None, None)
stat_time_tuple = uuid_time_object.CopyToStatTimeTuple()
self.assertEqual(stat_time_tuple, expected_stat_time_tuple)
def testProperties(self):
"""Tests the properties."""
uuid_object = uuid.UUID('00911b54-9ef4-11e1-be53-525400123456')
uuid_time_object = uuid_time.UUIDTime(timestamp=uuid_object.time)
self.assertEqual(uuid_time_object.timestamp, 0x1e19ef400911b54)
uuid_time_object = uuid_time.UUIDTime()
self.assertIsNone(uuid_time_object.timestamp)
def testCopyToDateTimeString(self):
"""Tests the CopyToDateTimeString function."""
uuid_object = uuid.UUID('00911b54-9ef4-11e1-be53-525400123456')
uuid_time_object = uuid_time.UUIDTime(timestamp=uuid_object.time)
date_time_string = uuid_time_object.CopyToDateTimeString()
self.assertEqual(date_time_string, '2012-05-16 01:11:01.6544084')
uuid_time_object = uuid_time.UUIDTime()
date_time_string = uuid_time_object.CopyToDateTimeString()
self.assertIsNone(date_time_string)
def testGetTimeOfDay(self):
"""Tests the GetTimeOfDay function."""
uuid_object = uuid.UUID('00911b54-9ef4-11e1-be53-525400123456')
uuid_time_object = uuid_time.UUIDTime(timestamp=uuid_object.time)
time_of_day_tuple = uuid_time_object.GetTimeOfDay()
self.assertEqual(time_of_day_tuple, (1, 11, 1))
uuid_time_object = uuid_time.UUIDTime()
time_of_day_tuple = uuid_time_object.GetTimeOfDay()
self.assertEqual(time_of_day_tuple, (None, None, None))
def testGetDate(self):
"""Tests the GetDate function."""
uuid_object = uuid.UUID('00911b54-9ef4-11e1-be53-525400123456')
uuid_time_object = uuid_time.UUIDTime(timestamp=uuid_object.time)
date_tuple = uuid_time_object.GetDate()
self.assertEqual(date_tuple, (2012, 5, 16))
uuid_time_object = uuid_time.UUIDTime()
date_tuple = uuid_time_object.GetDate()
self.assertEqual(date_tuple, (None, None, None))
def testCopyFromDateTimeString(self):
"""Tests the CopyFromDateTimeString function."""
uuid_time_object = uuid_time.UUIDTime()
expected_timestamp = 135946080000000000
uuid_time_object.CopyFromDateTimeString('2013-08-01')
self.assertEqual(uuid_time_object.timestamp, expected_timestamp)
expected_timestamp = 135946635280000000
uuid_time_object.CopyFromDateTimeString('2013-08-01 15:25:28')
self.assertEqual(uuid_time_object.timestamp, expected_timestamp)
expected_timestamp = 135946635285468750
uuid_time_object.CopyFromDateTimeString('2013-08-01 15:25:28.546875')
self.assertEqual(uuid_time_object.timestamp, expected_timestamp)
expected_timestamp = 135946671285468750
uuid_time_object.CopyFromDateTimeString('2013-08-01 15:25:28.546875-01:00')
self.assertEqual(uuid_time_object.timestamp, expected_timestamp)
expected_timestamp = 135946599285468750
uuid_time_object.CopyFromDateTimeString('2013-08-01 15:25:28.546875+01:00')
self.assertEqual(uuid_time_object.timestamp, expected_timestamp)
expected_timestamp = 864000000000
uuid_time_object.CopyFromDateTimeString('1582-10-16 00:00:00')
self.assertEqual(uuid_time_object.timestamp, expected_timestamp)
with self.assertRaises(ValueError):
uuid_time_object.CopyFromDateTimeString('1570-01-02 00:00:00')
def testInitialize(self):
"""Tests the initialization function."""
uuid_time_object = uuid_time.UUIDTime()
self.assertIsNotNone(uuid_time_object)
uuid_object = uuid.UUID('00911b54-9ef4-11e1-be53-525400123456')
uuid_time_object = uuid_time.UUIDTime(timestamp=uuid_object.time)
self.assertIsNotNone(uuid_time_object)
expected_timestamp = 135564234616544084
self.assertEqual(uuid_time_object.timestamp, expected_timestamp)
with self.assertRaises(ValueError):
uuid_time.UUIDTime(timestamp=0x1fffffffffffffff)
with self.assertRaises(ValueError):
uuid_time.UUIDTime(timestamp=-1)
def testCopyFromDateTimeString(self):
"""Tests the CopyFromDateTimeString function."""
uuid_time_object = uuid_time.UUIDTime()
uuid_time_object.CopyFromDateTimeString('2013-08-01')
self.assertEqual(uuid_time_object._timestamp, 135946080000000000)
self.assertEqual(uuid_time_object._time_zone_offset, 0)
uuid_time_object.CopyFromDateTimeString('2013-08-01 15:25:28')
self.assertEqual(uuid_time_object._timestamp, 135946635280000000)
self.assertEqual(uuid_time_object._time_zone_offset, 0)
uuid_time_object.CopyFromDateTimeString('2013-08-01 15:25:28.546875')
self.assertEqual(uuid_time_object._timestamp, 135946635285468750)
self.assertEqual(uuid_time_object._time_zone_offset, 0)
uuid_time_object.CopyFromDateTimeString('2013-08-01 15:25:28.546875-01:00')
self.assertEqual(uuid_time_object._timestamp, 135946635285468750)
self.assertEqual(uuid_time_object._time_zone_offset, -60)
uuid_time_object.CopyFromDateTimeString('2013-08-01 15:25:28.546875+01:00')
self.assertEqual(uuid_time_object._timestamp, 135946635285468750)
self.assertEqual(uuid_time_object._time_zone_offset, 60)
uuid_time_object.CopyFromDateTimeString('1582-10-16 00:00:00')
self.assertEqual(uuid_time_object._timestamp, 864000000000)
self.assertEqual(uuid_time_object._time_zone_offset, 0)
with self.assertRaises(ValueError):
uuid_time_object.CopyFromDateTimeString('1570-01-02 00:00:00')
def _ParseDistributedTrackingIdentifier(self, parser_mediator, uuid_data,
origin):
"""Extracts data from a Distributed Tracking identifier.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfvfs.
uuid_data (bytes): UUID data of the Distributed Tracking identifier.
origin (str): origin of the event (event source).
Returns:
str: UUID string of the Distributed Tracking identifier.
"""
uuid_object = uuid.UUID(bytes_le=uuid_data)
if uuid_object.version == 1:
event_data = windows_events.WindowsDistributedLinkTrackingEventData(
uuid_object, origin)
date_time = dfdatetime_uuid_time.UUIDTime(
timestamp=uuid_object.time)
event = time_events.DateTimeValuesEvent(
date_time, definitions.TIME_DESCRIPTION_CREATION)
parser_mediator.ProduceEventWithEventData(event, event_data)
return u'{{{0!s}}}'.format(uuid_object)
def _ParseDistributedTrackingIdentifier(self, parser_mediator, uuid_string,
origin):
"""Extracts data from a Distributed Tracking identifier.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfvfs.
uuid_string (str): UUID string of the Distributed Tracking identifier.
origin (str): origin of the event (event source).
"""
uuid_object = uuid.UUID(uuid_string)
if uuid_object.version == 1:
event_data = windows_events.WindowsDistributedLinkTrackingEventData(
uuid_object, origin)
date_time = dfdatetime_uuid_time.UUIDTime(
timestamp=uuid_object.time)
event = time_events.DateTimeValuesEvent(
date_time, eventdata.EventTimestamp.CREATION_TIME)
parser_mediator.ProduceEventWithEventData(event, event_data)