def _TestRead(self, parent_path_spec):
"""Test the read functionality.
Args:
parent_path_spec (PathSpec): parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=6, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context)
partition_offset = 352 * self._BYTES_PER_SECTOR
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR)
file_object.seek(0x2e900 - partition_offset)
expected_data = (
b'\xc0\x41\x00\x00\x00\x30\x00\x00\xc8\x8c\xb9\x52\xc8\x8c\xb9\x52'
b'\xc8\x8c\xb9\x52\x00\x00\x00\x00\x00\x00\x02\x00\x18\x00\x00\x00'
)
self.assertEqual(file_object.read(32), expected_data)
file_object.close()
def NewFileObject(self, resolver_context):
"""Creates a new file-like object.
Args:
resolver_context (Context): resolver context.
Returns:
FileIO: file-like object.
"""
return tsk_partition_file_io.TSKPartitionFile(resolver_context)
def _TestOpenClose(self, parent_path_spec):
"""Test the open and close functionality.
Args:
parent_path_spec: the parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=2, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 350 * self._BYTES_PER_SECTOR)
file_object.close()
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=13, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
with self.assertRaises(errors.PathSpecError):
file_object.open(path_spec=path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p2', parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR)
file_object.close()
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p0', parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
with self.assertRaises(errors.PathSpecError):
file_object.open(path_spec=path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location=u'/p3', parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
with self.assertRaises(errors.PathSpecError):
file_object.open(path_spec=path_spec)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
start_offset=(352 * self._BYTES_PER_SECTOR), parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR)
file_object.close()
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
start_offset=(350 * self._BYTES_PER_SECTOR), parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(self._resolver_context)
with self.assertRaises(errors.PathSpecError):
file_object.open(path_spec=path_spec)
def NewFileObject(self, resolver_context, path_spec):
"""Creates a new file input/output (IO) object.
Args:
resolver_context (Context): resolver context.
path_spec (PathSpec): a path specification.
Returns:
FileIO: file input/output (IO) object.
"""
return tsk_partition_file_io.TSKPartitionFile(resolver_context, path_spec)
def _TestSeek(self, parent_path_spec):
"""Test the seek functionality.
Args:
parent_path_spec (PathSpec): parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=6, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context)
partition_offset = 352 * self._BYTES_PER_SECTOR
file_object.open(path_spec=path_spec)
self.assertEqual(file_object.get_size(), 2528 * self._BYTES_PER_SECTOR)
file_object.seek(0x7420)
self.assertEqual(file_object.get_offset(), 0x33420 - partition_offset)
self.assertEqual(file_object.read(16),
b'lost+found\x00\x00\x00\x00\x00\x00')
self.assertEqual(file_object.get_offset(), 0x33430 - partition_offset)
file_object.seek(-1251324, os.SEEK_END)
self.assertEqual(file_object.get_offset(), 0x36804 - partition_offset)
self.assertEqual(file_object.read(8),
b'\x03\x00\x00\x00\x04\x00\x00\x00')
self.assertEqual(file_object.get_offset(), 0x3680c - partition_offset)
file_object.seek(4, os.SEEK_CUR)
self.assertEqual(file_object.get_offset(), 0x36810 - partition_offset)
self.assertEqual(file_object.read(7), b'\x06\x00\x00\x00\x00\x00\x00')
self.assertEqual(file_object.get_offset(), 0x36817 - partition_offset)
# Conforming to the POSIX seek the offset can exceed the file size
# but reading will result in no data being returned.
expected_offset = (2528 * self._BYTES_PER_SECTOR) + 100
file_object.seek(expected_offset, os.SEEK_SET)
self.assertEqual(file_object.get_offset(), expected_offset)
self.assertEqual(file_object.read(20), b'')
with self.assertRaises(IOError):
file_object.seek(-10, os.SEEK_SET)
# On error the offset should not change.
self.assertEqual(file_object.get_offset(), expected_offset)
with self.assertRaises(IOError):
file_object.seek(10, 5)
# On error the offset should not change.
self.assertEqual(file_object.get_offset(), expected_offset)
file_object.close()
def _TestSeek(self, parent_path_spec):
"""Test the seek functionality.
Args:
parent_path_spec (PathSpec): parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=6, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
file_object.Open()
self.assertEqual(file_object.get_size(), self._SIZE_P2)
file_object.seek(4128)
self.assertEqual(file_object.get_offset(), 0x11620 - self._OFFSET_P2)
self.assertEqual(file_object.read(16),
b'lost+found\x00\x00\x0c\x00\x00\x00')
self.assertEqual(file_object.get_offset(), 0x11630 - self._OFFSET_P2)
file_object.seek(-28156, os.SEEK_END)
self.assertEqual(file_object.get_offset(), 0x19a04 - self._OFFSET_P2)
data = file_object.read(8)
self.assertEqual(data, b' is a te')
self.assertEqual(file_object.get_offset(), 0x19a0c - self._OFFSET_P2)
file_object.seek(4, os.SEEK_CUR)
self.assertEqual(file_object.get_offset(), 0x19a10 - self._OFFSET_P2)
data = file_object.read(7)
self.assertEqual(data, b'ile.\n\nW')
self.assertEqual(file_object.get_offset(), 0x19a17 - self._OFFSET_P2)
# Conforming to the POSIX seek the offset can exceed the file size
# but reading will result in no data being returned.
expected_offset = self._SIZE_P2 + 100
file_object.seek(expected_offset, os.SEEK_SET)
self.assertEqual(file_object.get_offset(), expected_offset)
self.assertEqual(file_object.read(20), b'')
with self.assertRaises(IOError):
file_object.seek(-10, os.SEEK_SET)
# On error the offset should not change.
self.assertEqual(file_object.get_offset(), expected_offset)
with self.assertRaises(IOError):
file_object.seek(10, 5)
# On error the offset should not change.
self.assertEqual(file_object.get_offset(), expected_offset)
def _TestRead(self, parent_path_spec):
"""Test the read functionality.
Args:
parent_path_spec (PathSpec): parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=6, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
file_object.Open()
self.assertEqual(file_object.get_size(), self._SIZE_P2)
file_object.seek(0x19e00 - self._OFFSET_P2)
data = file_object.read(32)
self.assertEqual(data, b'place,user,password\nbank,joesmit')
def _TestOpenClose(self, parent_path_spec):
"""Test the open and close functionality.
Args:
parent_path_spec (PathSpec): parent path specification.
"""
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=2, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
file_object.Open()
self.assertEqual(file_object.get_size(), self._SIZE_P1)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
part_index=13, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
with self.assertRaises(errors.PathSpecError):
file_object.Open()
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p2', parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
file_object.Open()
self.assertEqual(file_object.get_size(), self._SIZE_P2)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p0', parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
with self.assertRaises(errors.PathSpecError):
file_object.Open()
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
location='/p3', parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
with self.assertRaises(errors.PathSpecError):
file_object.Open()
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
start_offset=self._OFFSET_P2, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
file_object.Open()
self.assertEqual(file_object.get_size(), self._SIZE_P2)
path_spec = tsk_partition_path_spec.TSKPartitionPathSpec(
start_offset=self._SIZE_P1, parent=parent_path_spec)
file_object = tsk_partition_file_io.TSKPartitionFile(
self._resolver_context, path_spec)
with self.assertRaises(errors.PathSpecError):
file_object.Open()