def testInitialize(self):
"""Tests the path specification initialization."""
path_spec = qcow_path_spec.QcowPathSpec(parent=self._path_spec)
self.assertNotEqual(path_spec, None)
with self.assertRaises(ValueError):
_ = qcow_path_spec.QcowPathSpec(parent=None)
with self.assertRaises(ValueError):
_ = qcow_path_spec.QcowPathSpec(parent=self._path_spec,
bogus=u'BOGUS')
def testGetVolumeSystemTypeIndicators(self):
"""Function to test the get volume system type indicators function."""
test_file = os.path.join(u'test_data', u'tsk_volume_system.raw')
path_spec = os_path_spec.OSPathSpec(location=test_file)
expected_type_indicators = [definitions.TYPE_INDICATOR_TSK_PARTITION]
type_indicators = analyzer.Analyzer.GetVolumeSystemTypeIndicators(
path_spec)
self.assertEqual(type_indicators, expected_type_indicators)
test_file = os.path.join(u'test_data', u'vsstest.qcow2')
path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = qcow_path_spec.QcowPathSpec(parent=path_spec)
expected_type_indicators = [definitions.TYPE_INDICATOR_VSHADOW]
type_indicators = analyzer.Analyzer.GetVolumeSystemTypeIndicators(
path_spec)
self.assertEqual(type_indicators, expected_type_indicators)
test_file = os.path.join(u'test_data', u'bdetogo.raw')
path_spec = os_path_spec.OSPathSpec(location=test_file)
expected_type_indicators = [definitions.TYPE_INDICATOR_BDE]
type_indicators = analyzer.Analyzer.GetVolumeSystemTypeIndicators(
path_spec)
self.assertEqual(type_indicators, expected_type_indicators)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
test_file = os.path.join(u'test_data', u'image.qcow2')
self._os_path_spec = os_path_spec.OSPathSpec(location=test_file)
self._qcow_path_spec = qcow_path_spec.QcowPathSpec(
parent=self._os_path_spec)
self._vshadow_path_spec = vshadow_path_spec.VShadowPathSpec(
store_index=1, parent=self._qcow_path_spec)
self._tsk_path_spec = tsk_path_spec.TSKPathSpec(
inode=16,
location=u'/a_directory/another_file',
parent=self._vshadow_path_spec)
test_path = os.path.abspath(test_file).encode(u'utf8')
test_path_length = len(test_path)
if test_path_length < 228:
self._proto_string = (
b'\n{0:s}\n{1:s}\n{2:s}'
b'\x12\x02OS2{3:s}{4:s}'
b'\x12\x04QCOW'
b'\x12\x07VSHADOWX\x01'
b'\x12\x03TSK(\x102\x19/a_directory/another_file').format(
chr(test_path_length + 27), chr(test_path_length + 14),
chr(test_path_length + 6), chr(test_path_length),
test_path)
self._proto = transmission_pb2.PathSpec()
self._proto.ParseFromString(self._proto_string)
def testScanForVolumeSystem(self):
"""Test the ScanForVolumeSystem() function."""
test_file = os.path.join(u'test_data', u'tsk_volume_system.raw')
source_path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = self._source_scanner.ScanForVolumeSystem(source_path_spec)
self.assertNotEqual(path_spec, None)
self.assertEqual(
path_spec.type_indicator, definitions.TYPE_INDICATOR_TSK_PARTITION)
test_file = os.path.join(u'test_data', u'vsstest.qcow2')
source_path_spec = os_path_spec.OSPathSpec(location=test_file)
source_path_spec = qcow_path_spec.QcowPathSpec(parent=source_path_spec)
path_spec = self._source_scanner.ScanForVolumeSystem(source_path_spec)
self.assertNotEqual(path_spec, None)
self.assertEqual(
path_spec.type_indicator, definitions.TYPE_INDICATOR_VSHADOW)
test_file = os.path.join(u'test_data', u'bdetogo.raw')
source_path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = self._source_scanner.ScanForVolumeSystem(source_path_spec)
self.assertNotEqual(path_spec, None)
self.assertEqual(path_spec.type_indicator, definitions.TYPE_INDICATOR_BDE)
test_file = os.path.join(u'test_data', u'mactime.body')
source_path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = self._source_scanner.ScanForVolumeSystem(source_path_spec)
self.assertEqual(path_spec, None)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
test_file = os.path.join(u'test_data', u'image.qcow2')
self._os_path_spec = os_path_spec.OSPathSpec(location=test_file)
self._qcow_path_spec = qcow_path_spec.QcowPathSpec(
parent=self._os_path_spec)
self._vshadow_path_spec = vshadow_path_spec.VShadowPathSpec(
store_index=1, parent=self._qcow_path_spec)
self._tsk_path_spec = tsk_path_spec.TSKPathSpec(
inode=16,
location=u'/a_directory/another_file',
parent=self._vshadow_path_spec)
test_path = os.path.abspath(test_file).encode(u'utf8')
self._json_dict = {
u'__type__': u'PathSpec',
u'type_indicator': u'TSK',
u'location': u'/a_directory/another_file',
u'inode': 16,
u'parent': {
u'__type__': u'PathSpec',
u'type_indicator': u'VSHADOW',
u'store_index': 1,
u'parent': {
u'__type__': u'PathSpec',
u'type_indicator': u'QCOW',
u'parent': {
u'__type__': u'PathSpec',
u'type_indicator': u'OS',
u'location': test_path
}
}
}
}
def setUp(self):
"""Sets up the needed objects used throughout the test."""
self._resolver_context = context.Context()
test_file = os.path.join(u'test_data', u'vsstest.qcow2')
path_spec = os_path_spec.OSPathSpec(location=test_file)
self._qcow_path_spec = qcow_path_spec.QcowPathSpec(parent=path_spec)
self._vshadow_path_spec = vshadow_path_spec.VShadowPathSpec(
location=u'/', parent=self._qcow_path_spec)
def testComparable(self):
"""Tests the path specification comparable property."""
path_spec = qcow_path_spec.QcowPathSpec(parent=self._path_spec)
self.assertNotEqual(path_spec, None)
expected_comparable = u'\n'.join([u'type: TEST', u'type: QCOW', u''])
self.assertEqual(path_spec.comparable, expected_comparable)
def testGetFileSystemTypeIndicators(self):
"""Function to test the get file system type indicators function."""
test_file = os.path.join(u'test_data', u'vsstest.qcow2')
path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = qcow_path_spec.QcowPathSpec(parent=path_spec)
path_spec = vshadow_path_spec.VShadowPathSpec(store_index=1,
parent=path_spec)
expected_type_indicators = [definitions.TYPE_INDICATOR_TSK]
type_indicators = analyzer.Analyzer.GetFileSystemTypeIndicators(
path_spec)
self.assertEqual(type_indicators, expected_type_indicators)
def testScanForFileSystem(self):
"""Test the ScanForFileSystem() function."""
test_file = os.path.join(u'test_data', u'vsstest.qcow2')
source_path_spec = os_path_spec.OSPathSpec(location=test_file)
source_path_spec = qcow_path_spec.QcowPathSpec(parent=source_path_spec)
source_path_spec = vshadow_path_spec.VShadowPathSpec(
store_index=1, parent=source_path_spec)
path_spec = self._source_scanner.ScanForFileSystem(source_path_spec)
self.assertNotEqual(path_spec, None)
self.assertEqual(path_spec.type_indicator, definitions.TYPE_INDICATOR_TSK)
test_file = os.path.join(u'test_data', u'mactime.body')
source_path_spec = os_path_spec.OSPathSpec(location=test_file)
path_spec = self._source_scanner.ScanForFileSystem(source_path_spec)
self.assertEqual(path_spec, None)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
self._resolver_context = context.Context()
test_file = os.path.join(os.getcwd(), u'test_data')
self._os_path_spec = os_path_spec.OSPathSpec(location=test_file)
self._os_file_system = os_file_system.OSFileSystem(self._resolver_context)
# TODO: add RAW volume only test image.
test_file = os.path.join(u'test_data', u'vsstest.qcow2')
path_spec = os_path_spec.OSPathSpec(location=test_file)
self._qcow_path_spec = qcow_path_spec.QcowPathSpec(parent=path_spec)
self._tsk_path_spec = tsk_path_spec.TSKPathSpec(
location=u'/', parent=self._qcow_path_spec)
self._tsk_file_system = tsk_file_system.TSKFileSystem(
self._resolver_context)
self._tsk_file_system.Open(path_spec=self._tsk_path_spec)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
super(QcowFileTest, self).setUp()
test_file = os.path.join(u'test_data', u'image.qcow2')
path_spec = os_path_spec.OSPathSpec(location=test_file)
self._qcow_path_spec = qcow_path_spec.QcowPathSpec(parent=path_spec)