예제 #1
0
  def testProcess(self):
    """Tests the Process function."""
    plist_name = 'com.apple.spotlight.plist'

    plugin = spotlight.SpotlightPlugin()
    storage_writer = self._ParsePlistFileWithPlugin(
        plugin, [plist_name], plist_name)

    self.assertEqual(storage_writer.number_of_events, 9)

    # The order in which PlistParser generates events is nondeterministic
    # hence we sort the events.
    events = list(storage_writer.GetSortedEvents())

    expected_timestamps = [
        1375236414408299, 1376696381196456, 1379937262090907, 1380942616952360,
        1386111811136094, 1386951868185478, 1387822901900938, 1388331212005130,
        1389056477460443]
    timestamps = sorted([event.timestamp for event in events])

    self.assertEqual(timestamps, expected_timestamps)

    event = events[6]
    self.assertEqual(event.key, 'gr')
    self.assertEqual(event.root, '/UserShortcuts')

    expected_description = (
        'Spotlight term searched "gr" associate to Grab '
        '(/Applications/Utilities/Grab.app)')
    self.assertEqual(event.desc, expected_description)

    expected_message = '/UserShortcuts/gr {0:s}'.format(expected_description)
    expected_short_message = '{0:s}...'.format(expected_message[:77])
    self._TestGetMessageStrings(event, expected_message, expected_short_message)
예제 #2
0
    def testProcess(self):
        """Tests the Process function."""
        plist_name = 'com.apple.spotlight.plist'

        plugin = spotlight.SpotlightPlugin()
        storage_writer = self._ParsePlistFileWithPlugin(
            plugin, [plist_name], plist_name)

        number_of_events = storage_writer.GetNumberOfAttributeContainers(
            'event')
        self.assertEqual(number_of_events, 9)

        number_of_warnings = storage_writer.GetNumberOfAttributeContainers(
            'extraction_warning')
        self.assertEqual(number_of_warnings, 0)

        number_of_warnings = storage_writer.GetNumberOfAttributeContainers(
            'recovery_warning')
        self.assertEqual(number_of_warnings, 0)

        # The order in which PlistParser generates events is nondeterministic
        # hence we sort the events.
        events = list(storage_writer.GetSortedEvents())

        expected_timestamps = [
            1375236414408299, 1376696381196456, 1379937262090907,
            1380942616952360, 1386111811136094, 1386951868185478,
            1387822901900938, 1388331212005130, 1389056477460443
        ]
        timestamps = sorted([event.timestamp for event in events])

        self.assertEqual(timestamps, expected_timestamps)

        expected_event_values = {
            'data_type':
            'plist:key',
            'desc': ('Spotlight term searched "gr" associate to Grab '
                     '(/Applications/Utilities/Grab.app)'),
            'key':
            'gr',
            'root':
            '/UserShortcuts'
        }

        self.CheckEventValues(storage_writer, events[6], expected_event_values)
예제 #3
0
파일: spotlight.py 프로젝트: kr11/plaso
 def setUp(self):
     """Makes preparations before running an individual test."""
     self._plugin = spotlight.SpotlightPlugin()
     self._parser = plist.PlistParser()
예제 #4
0
 def setUp(self):
     """Sets up the needed objects used throughout the test."""
     self._plugin = spotlight.SpotlightPlugin()
     self._parser = plist.PlistParser()
예제 #5
0
 def setUp(self):
   """Sets up the needed objects used throughout the test."""
   self._plugin = spotlight.SpotlightPlugin(None)
   self._parser = plist.PlistParser(event.PreprocessObject(), None)