def test_init(self): mft = MftTable(filename='sample_images/ntfs_mft_table.bin', ) entry = mft.get_entry(0) header = entry.header self.assertEqual(header.signature, b'FILE') self.assertEqual(header.upd_seq_array_offset, 0x30) self.assertEqual(header.upd_seq_array_size, 0x3) self.assertEqual(header.logfile_seq_number, 0x104D82) self.assertEqual(header.seq_number, 0x1) self.assertEqual(header.hard_link_count, 0x1) self.assertEqual(header.first_attr_offset, 0x38) self.assertEqual(header.flags, 0x1) self.assertEqual(header.used_size, 0x1A0) self.assertEqual(header.allocated_size, 0x400) self.assertEqual(header.base_file_record, 0x0) self.assertEqual(header.next_attr_id, 0x0) self.assertEqual(header.mft_record_number, 0x0) self.assertEqual(len(entry.attributes), 4) self.assertEqual(entry.fname_str, '$MFT') self.assertEqual(entry.name_str, 'Master File Table') self.assertFalse(entry.is_directory) self.assertTrue(entry.is_file) self.assertTrue(entry.is_in_use) self.assertTrue(entry.lookup_attribute(0x10) is not None)
def test_init(self): mft = MftTable(filename='sample_images/ntfs_mft_table.bin', ) self.assertEqual(len(mft._entries), 0) entry = mft.get_entry(0) self.assertTrue(entry is not None) self.assertEqual(len(mft._entries), 1)
def test_get_entry(self): mft = MftTable(filename='sample_images/ntfs_mft_table.bin', ) self.assertTrue(mft.get_entry(0) is not None) self.assertEqual(len(mft._entries), 1) self.assertTrue(mft.get_entry(3) is not None) self.assertTrue(mft.get_entry(2) is not None) self.assertEqual(len(mft._entries), 3)