def testListFiles_alternateDataStreams_fileOnly(self): with self._client.Open(path="\\ads\\ads.txt") as file_obj: files = file_obj.ListFiles() files = list(files) files.sort(key=lambda x: x.name) expected_files = [ filesystem_pb2.StatEntry( name="ads.txt", st_ino=ADS_ADS_TXT_FILE_REF, stream_name="one", st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"), st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"), st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"), st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"), ntfs=S_DEFAULT_FILE, st_size=6, ), filesystem_pb2.StatEntry( name="ads.txt", st_ino=ADS_ADS_TXT_FILE_REF, stream_name="two", st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"), st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"), st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"), st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"), ntfs=S_DEFAULT_FILE, st_size=7, ), ] self.assertEqual(files, expected_files)
def testListFiles_alternateDataStreams(self): with self._client.Open(path=self._Path("\\ads")) as file_obj: files = file_obj.ListFiles() files = list(files) files.sort(key=lambda x: x.name) expected_files = [ self._ExpectedStatEntry( filesystem_pb2.StatEntry( name="ads.txt", st_ino=self._FileRefToInode(ADS_ADS_TXT_FILE_REF), st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"), st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"), st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"), st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"), ntfs=S_DEFAULT_FILE, st_size=5, st_gid=0, st_uid=48, st_nlink=1, st_mode=S_MODE_DEFAULT, )), self._ExpectedStatEntry( filesystem_pb2.StatEntry( name="ads.txt", st_ino=self._FileRefToInode(ADS_ADS_TXT_FILE_REF), stream_name="one", st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"), st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"), st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"), st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"), ntfs=S_DEFAULT_FILE, st_size=6, st_gid=0, st_uid=48, st_nlink=1, st_mode=S_MODE_DEFAULT, )), self._ExpectedStatEntry( filesystem_pb2.StatEntry( name="ads.txt", st_ino=self._FileRefToInode(ADS_ADS_TXT_FILE_REF), stream_name="two", st_atime=_ParseTimestamp("2020-04-07 13:48:51.172681"), st_btime=_ParseTimestamp("2020-04-07 13:18:53.793003"), st_mtime=_ParseTimestamp("2020-04-07 13:48:56.308416"), st_ctime=_ParseTimestamp("2020-04-07 13:48:56.308416"), ntfs=S_DEFAULT_FILE, st_size=7, st_gid=0, st_uid=48, st_nlink=1, st_mode=S_MODE_DEFAULT, )), ] self.assertEqual(files, expected_files)
def _Stat( self, fd: pytsk3.File, data_stream: Optional[pytsk3.Attribute], ) -> filesystem_pb2.StatEntry: st = filesystem_pb2.StatEntry() if fd.info.name is not None: name = fd.info.name if name.name is not None: st.name = _DecodeName(name.name) st.st_mode |= _FS_NAME_TYPE_LOOKUP.get(int(name.type), 0) if fd.info.meta is not None: meta = fd.info.meta if hasattr(meta, "mode"): st.st_mode |= _FixInt(int(meta.mode)) if hasattr(meta, "nlink"): st.st_nlink = _FixInt(meta.nlink) if hasattr(meta, "uid"): st.st_uid = _FixInt(meta.uid) if hasattr(meta, "gid"): st.st_gid = _FixInt(meta.gid) if hasattr(meta, "addr"): st.st_ino = meta.addr if hasattr(meta, "atime"): st.st_atime.FromSeconds(_FixInt(meta.atime)) if hasattr(meta, "mtime"): st.st_mtime.FromSeconds(_FixInt(meta.mtime)) if hasattr(meta, "crtime"): st.st_btime.FromSeconds(_FixInt(meta.crtime)) if hasattr(meta, "ctime"): st.st_ctime.FromSeconds(_FixInt(meta.ctime)) if hasattr(meta, "type"): st.st_mode |= _FS_META_TYPE_LOOKUP.get(_FixInt(int(meta.type)), 0) if hasattr(meta, "size"): if not stat.S_ISDIR(st.st_mode): st.st_size = _FixInt(meta.size) if data_stream is not None: if data_stream.info.name is not None: st.stream_name = _DecodeName(data_stream.info.name) st.st_size = data_stream.info.size if self._fs_info.info.ftype == pytsk3.TSK_FS_TYPE_NTFS: st.st_mode = _FixNtfsMode(st.st_mode) return st
def _Stat( self, entry: pyfsntfs.file_entry, data_stream: pyfsntfs.data_stream, ) -> filesystem_pb2.StatEntry: st = filesystem_pb2.StatEntry() if entry.name is not None: st.name = entry.name st.st_ino = entry.file_reference st.st_atime.FromDatetime(entry.get_access_time()) st.st_mtime.FromDatetime(entry.get_modification_time()) st.st_btime.FromDatetime(entry.get_creation_time()) st.st_ctime.FromDatetime(entry.get_entry_modification_time()) st.ntfs.is_directory = entry.has_directory_entries_index() if not entry.has_directory_entries_index() and data_stream is not None: st.st_size = data_stream.get_size() if entry != data_stream and data_stream is not None: st.stream_name = data_stream.name st.ntfs.flags = entry.file_attribute_flags return st
def testListFiles(self): with self._client.Open(path=self._Path("\\")) as file_obj: files = file_obj.ListFiles() files = [f for f in files if not f.name.startswith("$")] files = list(files) files.sort(key=lambda x: x.name) expected_files = [ self._ExpectedStatEntry( filesystem_pb2.StatEntry( name="a", st_ino=self._FileRefToInode(A_FILE_REF), st_atime=_ParseTimestamp("2020-03-03 16:48:16.371823"), st_btime=_ParseTimestamp("2020-03-03 16:47:43.605063"), st_mtime=_ParseTimestamp("2020-03-03 16:47:50.945764"), st_ctime=_ParseTimestamp("2020-03-03 16:47:50.945764"), ntfs=S_DEFAULT_DIR, st_gid=0, st_uid=48, st_nlink=1, st_mode=S_MODE_DIR, )), self._ExpectedStatEntry( filesystem_pb2.StatEntry( name="ads", st_ino=self._FileRefToInode(ADS_FILE_REF), st_atime=_ParseTimestamp("2020-04-07 14:57:02.655592"), st_btime=_ParseTimestamp("2020-04-07 13:23:07.389499"), st_mtime=_ParseTimestamp("2020-04-07 14:56:47.778178"), st_ctime=_ParseTimestamp("2020-04-07 14:56:47.778178"), ntfs=S_DEFAULT_DIR, st_gid=0, st_uid=48, st_nlink=1, st_mode=S_MODE_DIR, )), self._ExpectedStatEntry( filesystem_pb2.StatEntry( name="hidden_file.txt", st_ino=self._FileRefToInode(HIDDEN_FILE_TXT_FILE_REF), st_atime=_ParseTimestamp("2020-04-08 20:14:38.260081"), st_btime=_ParseTimestamp("2020-04-08 20:14:38.259955"), st_mtime=_ParseTimestamp("2020-04-08 20:14:38.260081"), st_ctime=_ParseTimestamp("2020-04-08 20:15:07.835354"), ntfs=filesystem_pb2.StatEntry.Ntfs( is_directory=False, flags=stat.FILE_ATTRIBUTE_ARCHIVE | stat.FILE_ATTRIBUTE_HIDDEN), st_size=0, st_gid=0, st_uid=48, st_nlink=1, st_mode=S_MODE_HIDDEN, )), self._ExpectedStatEntry( filesystem_pb2.StatEntry( name="numbers.txt", st_ino=self._FileRefToInode(NUMBERS_TXT_FILE_REF), st_atime=_ParseTimestamp("2020-03-03 20:10:46.353317"), st_btime=_ParseTimestamp("2020-03-03 16:46:00.630537"), st_mtime=_ParseTimestamp("2020-03-03 20:10:46.353317"), st_ctime=_ParseTimestamp("2020-03-03 20:10:46.353317"), ntfs=S_DEFAULT_FILE, st_size=3893, st_gid=0, st_uid=48, st_nlink=1, st_mode=S_MODE_DEFAULT, )), self._ExpectedStatEntry( filesystem_pb2.StatEntry( name="read_only_file.txt", st_ino=self._FileRefToInode( READ_ONLY_FILE_TXT_FILE_REF), st_atime=_ParseTimestamp("2020-04-08 20:14:33.306681"), st_btime=_ParseTimestamp("2020-04-08 20:14:33.306441"), st_mtime=_ParseTimestamp("2020-04-08 20:14:33.306681"), st_ctime=_ParseTimestamp("2020-04-08 20:14:55.254657"), ntfs=filesystem_pb2.StatEntry.Ntfs( is_directory=False, flags=stat.FILE_ATTRIBUTE_ARCHIVE | stat.FILE_ATTRIBUTE_READONLY), st_size=0, st_gid=0, st_uid=48, st_nlink=1, st_mode=S_MODE_READ_ONLY, )), self._ExpectedStatEntry( filesystem_pb2.StatEntry( name="入乡随俗 海外春节别样过法.txt", st_ino=self._FileRefToInode(CHINESE_FILE_FILE_REF), st_atime=_ParseTimestamp("2020-06-10 13:34:36.872637"), st_btime=_ParseTimestamp("2020-06-10 13:34:36.872637"), st_mtime=_ParseTimestamp("2020-06-10 13:34:36.872802"), st_ctime=_ParseTimestamp("2020-06-10 13:34:36.872802"), ntfs=S_DEFAULT_FILE, st_size=26, st_gid=0, st_uid=48, st_nlink=1, st_mode=S_MODE_DEFAULT, )), ] self.assertEqual(files, expected_files)