def test_open_close(self):
"""Tests the open and close functions."""
if not unittest.source:
return
fsntfs_volume = pyfsntfs.volume()
# Test open and close.
fsntfs_volume.open(unittest.source)
fsntfs_volume.close()
# Test open and close a second time to validate clean up on close.
fsntfs_volume.open(unittest.source)
fsntfs_volume.close()
file_object = open(unittest.source, "rb")
# Test open_file_object and close.
fsntfs_volume.open_file_object(file_object)
fsntfs_volume.close()
# Test open_file_object and close a second time to validate clean up on close.
fsntfs_volume.open_file_object(file_object)
fsntfs_volume.close()
# Test open_file_object and close and dereferencing file_object.
fsntfs_volume.open_file_object(file_object)
del file_object
fsntfs_volume.close()
def _Open(self, path_spec, mode='rb'):
"""Opens the file system object defined by path specification.
Args:
path_spec (PathSpec): path specification.
mode (Optional[str]): file access mode.
Raises:
AccessError: if the access to open the file was denied.
IOError: if the file system object could not be opened.
PathSpecError: if the path specification is incorrect.
ValueError: if the path specification is invalid.
"""
if not path_spec.HasParent():
raise errors.PathSpecError(
u'Unsupported path specification without parent.')
try:
file_object = resolver.Resolver.OpenFileObject(
path_spec.parent, resolver_context=self._resolver_context)
fsnfts_volume = pyfsntfs.volume()
fsnfts_volume.open_file_object(file_object)
except:
file_object.close()
raise
self._file_object = file_object
self._fsntfs_volume = fsnfts_volume
def test_open_close(self):
"""Tests the open and close functions."""
if not unittest.source:
raise unittest.SkipTest('missing source')
if unittest.offset:
raise unittest.SkipTest('source defines offset')
fsntfs_volume = pyfsntfs.volume()
# Test open and close.
fsntfs_volume.open(unittest.source)
fsntfs_volume.close()
# Test open and close a second time to validate clean up on close.
fsntfs_volume.open(unittest.source)
fsntfs_volume.close()
file_object = open(unittest.source, "rb")
# Test open_file_object and close.
fsntfs_volume.open_file_object(file_object)
fsntfs_volume.close()
# Test open_file_object and close a second time to validate clean up on close.
fsntfs_volume.open_file_object(file_object)
fsntfs_volume.close()
# Test open_file_object and close and dereferencing file_object.
fsntfs_volume.open_file_object(file_object)
del file_object
fsntfs_volume.close()
def test_open_file_object(self):
"""Tests the open_file_object function."""
if not unittest.source:
raise unittest.SkipTest("missing source")
if not os.path.isfile(unittest.source):
raise unittest.SkipTest("source not a regular file")
fsntfs_volume = pyfsntfs.volume()
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume.open_file_object(file_object)
with self.assertRaises(IOError):
fsntfs_volume.open_file_object(file_object)
fsntfs_volume.close()
# TODO: change IOError into TypeError
with self.assertRaises(IOError):
fsntfs_volume.open_file_object(None)
with self.assertRaises(ValueError):
fsntfs_volume.open_file_object(file_object, mode="w")
def test_open_close(self):
"""Tests the open and close functions."""
if not unittest.source:
return
if unittest.offset:
raise unittest.SkipTest("source defines offset")
fsntfs_volume = pyfsntfs.volume()
# Test open and close.
fsntfs_volume.open(unittest.source)
fsntfs_volume.close()
# Test open and close a second time to validate clean up on close.
fsntfs_volume.open(unittest.source)
fsntfs_volume.close()
if os.path.isfile(unittest.source):
with open(unittest.source, "rb") as file_object:
# Test open_file_object and close.
fsntfs_volume.open_file_object(file_object)
fsntfs_volume.close()
# Test open_file_object and close a second time to validate clean up on close.
fsntfs_volume.open_file_object(file_object)
fsntfs_volume.close()
# Test open_file_object and close and dereferencing file_object.
fsntfs_volume.open_file_object(file_object)
del file_object
fsntfs_volume.close()
def _Open(self, path_spec, mode='rb'):
"""Opens the file system object defined by path specification.
Args:
path_spec: a path specification (instance of PathSpec).
mode: optional file access mode. The default is 'rb' read-only binary.
Raises:
AccessError: if the access to open the file was denied.
IOError: if the file system object could not be opened.
PathSpecError: if the path specification is incorrect.
ValueError: if the path specification is invalid.
"""
if not path_spec.HasParent():
raise errors.PathSpecError(
u'Unsupported path specification without parent.')
try:
file_object = resolver.Resolver.OpenFileObject(
path_spec.parent, resolver_context=self._resolver_context)
fsnfts_volume = pyfsntfs.volume()
fsnfts_volume.open_file_object(file_object)
except:
file_object.close()
raise
self._file_object = file_object
self._fsntfs_volume = fsnfts_volume
def _Open(self, mode='rb'):
"""Opens the file system object defined by path specification.
Args:
mode (Optional[str]): file access mode. The default is 'rb' which
represents read-only binary.
Raises:
AccessError: if the access to open the file was denied.
IOError: if the file system object could not be opened.
PathSpecError: if the path specification is incorrect.
ValueError: if the path specification is invalid.
"""
if not self._path_spec.HasParent():
raise errors.PathSpecError(
'Unsupported path specification without parent.')
file_object = resolver.Resolver.OpenFileObject(
self._path_spec.parent, resolver_context=self._resolver_context)
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
self._file_object = file_object
self._fsntfs_volume = fsntfs_volume
def test_get_usn_change_journal(self):
"""Tests the get_usn_change_journal function and usn_change_journal property."""
if not unittest.source:
raise unittest.SkipTest("missing source")
fsntfs_volume = pyfsntfs.volume()
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
_ = fsntfs_volume.get_usn_change_journal()
fsntfs_volume.close()
def test_get_root_directory(self):
"""Tests the get_root_directory function and root_directory property."""
if not unittest.source:
raise unittest.SkipTest("missing source")
fsntfs_volume = pyfsntfs.volume()
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
root_directory = fsntfs_volume.get_root_directory()
self.assertIsNotNone(root_directory)
fsntfs_volume.close()
def test_close(self):
"""Tests the close function."""
if not unittest.source:
raise unittest.SkipTest("missing source")
fsntfs_volume = pyfsntfs.volume()
with self.assertRaises(IOError):
fsntfs_volume.close()
def pyfsntfs_test_seek_file(filename):
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open(filename, "r")
fsntfs_file_entry = fsntfs_volume.get_file_entry_by_path("\\$UpCase")
result = pyfsntfs_test_seek(fsntfs_file_entry)
fsntfs_volume.close()
return result
def pyfsntfs_test_read_file(filename):
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open(filename, "r")
fsntfs_file_entry = fsntfs_volume.get_file_entry_by_path("\\$UpCase")
result = pyfsntfs_test_read(fsntfs_file_entry)
fsntfs_volume.close()
return result
def test_get_index_entry_size(self):
"""Tests the get_index_entry_size function and index_entry_size property."""
if not unittest.source:
raise unittest.SkipTest("missing source")
fsntfs_volume = pyfsntfs.volume()
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
index_entry_size = fsntfs_volume.get_index_entry_size()
self.assertIsNotNone(index_entry_size)
self.assertIsNotNone(fsntfs_volume.index_entry_size)
fsntfs_volume.close()
def test_get_serial_number(self):
"""Tests the get_serial_number function and serial_number property."""
if not unittest.source:
raise unittest.SkipTest("missing source")
fsntfs_volume = pyfsntfs.volume()
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
serial_number = fsntfs_volume.get_serial_number()
self.assertIsNotNone(serial_number)
self.assertIsNotNone(fsntfs_volume.serial_number)
fsntfs_volume.close()
def test_get_number_of_file_entries(self):
"""Tests the get_number_of_file_entries function and number_of_file_entries property."""
if not unittest.source:
raise unittest.SkipTest("missing source")
fsntfs_volume = pyfsntfs.volume()
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
number_of_file_entries = fsntfs_volume.get_number_of_file_entries()
self.assertIsNotNone(number_of_file_entries)
self.assertIsNotNone(fsntfs_volume.number_of_file_entries)
fsntfs_volume.close()
def pyfsntfs_test_seek_file_object(filename):
file_object = open(filename, "rb")
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object, "r")
fsntfs_file_entry = fsntfs_volume.get_file_entry_by_path("\\$UpCase")
result = pyfsntfs_test_seek(fsntfs_file_entry)
fsntfs_volume.close()
return result
def pyfsntfs_test_read_file_object(filename):
file_object = open(filename, "rb")
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object, "r")
fsntfs_file_entry = fsntfs_volume.get_file_entry_by_path("\\$UpCase")
result = pyfsntfs_test_read(fsntfs_file_entry)
fsntfs_volume.close()
return result
def test_get_name(self):
"""Tests the get_name function and name property."""
test_source = unittest.source
if not test_source:
raise unittest.SkipTest("missing source")
fsntfs_volume = pyfsntfs.volume()
with DataRangeFileObject(test_source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
name = fsntfs_volume.get_name()
self.assertIsNotNone(name)
self.assertIsNotNone(fsntfs_volume.name)
fsntfs_volume.close()
def test_get_file_entry_by_path(self):
"""Tests the get_file_entry_by_path function."""
if not unittest.source:
raise unittest.SkipTest('missing source')
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
file_entry = fsntfs_volume.get_file_entry_by_path('\\$MFT')
self.assertIsNotNone(file_entry)
fsntfs_volume.close()
def test_get_usn_change_journal(self):
"""Tests the get_usn_change_journal function."""
if not unittest.source:
raise unittest.SkipTest('missing source')
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
# Test invocation only.
fsntfs_volume.get_usn_change_journal()
fsntfs_volume.close()
def test_get_cluster_block_size(self):
"""Tests the get_cluster_block_size function and cluster_block_size property."""
if not unittest.source:
raise unittest.SkipTest('missing source')
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
cluster_block_size = fsntfs_volume.get_cluster_block_size()
self.assertIsNotNone(cluster_block_size)
self.assertIsNotNone(fsntfs_volume.cluster_block_size)
fsntfs_volume.close()
def pyfsntfs_test_single_open_close_file(filename, mode):
if not filename:
filename_string = "None"
else:
filename_string = filename
print("Testing single open close of: {0:s} with access: {1:s}\t".format(
filename_string, get_mode_string(mode)))
result = True
try:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open(filename, mode)
fsntfs_volume.close()
except TypeError as exception:
expected_message = (
"{0:s}: unsupported string object type.").format(
"pyfsntfs_volume_open")
if not filename and str(exception) == expected_message:
pass
else:
print(str(exception))
result = False
except ValueError as exception:
expected_message = (
"{0:s}: unsupported mode: w.").format(
"pyfsntfs_volume_open")
if mode != "w" or str(exception) != expected_message:
print(str(exception))
result = False
except Exception as exception:
print(str(exception))
result = False
if not result:
print("(FAIL)")
else:
print("(PASS)")
return result
def test_get_bytes_per_sector(self):
"""Tests the get_bytes_per_sector function and bytes_per_sector property."""
if not unittest.source:
raise unittest.SkipTest('missing source')
with DataRangeFileObject(unittest.source, unittest.offset or 0,
None) as file_object:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
bytes_per_sector = fsntfs_volume.get_bytes_per_sector()
self.assertIsNotNone(bytes_per_sector)
self.assertIsNotNone(fsntfs_volume.bytes_per_sector)
fsntfs_volume.close()
def pyfsntfs_test_single_open_close_file(filename, mode):
if not filename:
filename_string = "None"
else:
filename_string = filename
print("Testing single open close of: {0:s} with access: {1:s}\t".format(
filename_string, get_mode_string(mode)))
result = True
try:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open(filename, mode)
fsntfs_volume.close()
except TypeError as exception:
expected_message = ("{0:s}: unsupported string object type."
).format("pyfsntfs_volume_open")
if not filename and str(exception) == expected_message:
pass
else:
print(str(exception))
result = False
except ValueError as exception:
expected_message = (
"{0:s}: unsupported mode: w.").format("pyfsntfs_volume_open")
if mode != "w" or str(exception) != expected_message:
print(str(exception))
result = False
except Exception as exception:
print(str(exception))
result = False
if not result:
print("(FAIL)")
else:
print("(PASS)")
return result
def ParseFileObject(self, parser_mediator, file_object, **kwargs):
"""Parses a NTFS $UsnJrnl metadata file-like object.
Args:
parser_mediator: A parser mediator object (instance of ParserMediator).
file_object: A file-like object.
"""
volume = pyfsntfs.volume()
try:
volume.open_file_object(file_object)
except IOError as exception:
parser_mediator.ProduceParseError(
u'unable to open NTFS volume with error: {0:s}'.format(exception))
try:
usn_change_journal = volume.get_usn_change_journal()
self._ParseUSNChangeJournal(parser_mediator, usn_change_journal)
finally:
volume.close()
def ParseFileObject(self, parser_mediator, file_object, **kwargs):
"""Parses a NTFS $UsnJrnl metadata file-like object.
Args:
parser_mediator: A parser mediator object (instance of ParserMediator).
file_object: A file-like object.
"""
volume = pyfsntfs.volume()
try:
volume.open_file_object(file_object)
except IOError as exception:
parser_mediator.ProduceParseError(
u'unable to open NTFS volume with error: {0:s}'.format(exception))
try:
usn_change_journal = volume.get_usn_change_journal()
self._ParseUSNChangeJournal(parser_mediator, usn_change_journal)
finally:
volume.close()
def test_open(self):
"""Tests the open function."""
if not unittest.source:
return
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open(unittest.source)
with self.assertRaises(IOError):
fsntfs_volume.open(unittest.source)
fsntfs_volume.close()
with self.assertRaises(TypeError):
fsntfs_volume.open(None)
with self.assertRaises(ValueError):
fsntfs_volume.open(unittest.source, mode="w")
def ParseFileObject(self, parser_mediator, file_object):
"""Parses a NTFS $UsnJrnl metadata file-like object.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO): file-like object.
"""
volume = pyfsntfs.volume()
try:
volume.open_file_object(file_object)
except IOError as exception:
parser_mediator.ProduceExtractionError(
'unable to open NTFS volume with error: {0!s}'.format(exception))
try:
usn_change_journal = volume.get_usn_change_journal()
self._ParseUSNChangeJournal(parser_mediator, usn_change_journal)
finally:
volume.close()
def ParseFileObject(self, parser_mediator, file_object):
"""Parses a NTFS $UsnJrnl metadata file-like object.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO): file-like object.
"""
volume = pyfsntfs.volume()
try:
volume.open_file_object(file_object)
except IOError as exception:
parser_mediator.ProduceExtractionWarning(
'unable to open NTFS volume with error: {0!s}'.format(exception))
try:
usn_change_journal = volume.get_usn_change_journal()
self._ParseUSNChangeJournal(parser_mediator, usn_change_journal)
finally:
volume.close()
def pyfsntfs_test_single_open_close_file_object(filename, mode):
print(("Testing single open close of file-like object of: {0:s} "
"with access: {1:s}\t").format(filename, get_mode_string(mode)))
result = True
try:
file_object = open(filename, "rb")
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object, mode)
fsntfs_volume.close()
except Exception as exception:
print(str(exception))
result = False
if not result:
print("(FAIL)")
else:
print("(PASS)")
return result
def pyfsntfs_test_single_open_close_file_object(filename, mode):
print(("Testing single open close of file-like object of: {0:s} "
"with access: {1:s}\t").format(filename, get_mode_string(mode)))
result = True
try:
file_object = open(filename, "rb")
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object, mode)
fsntfs_volume.close()
except Exception as exception:
print(str(exception))
result = False
if not result:
print("(FAIL)")
else:
print("(PASS)")
return result
def pyfsntfs_test_multi_open_close_file(filename, mode):
print("Testing multi open close of: {0:s} with access: {1:s}\t".format(
filename, get_mode_string(mode)))
result = True
try:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open(filename, mode)
fsntfs_volume.close()
fsntfs_volume.open(filename, mode)
fsntfs_volume.close()
except Exception as exception:
print(str(exception))
result = False
if not result:
print("(FAIL)")
else:
print("(PASS)")
return result
def pyfsntfs_test_multi_open_close_file(filename, mode):
print("Testing multi open close of: {0:s} with access: {1:s}\t".format(
filename, get_mode_string(mode)))
result = True
try:
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open(filename, mode)
fsntfs_volume.close()
fsntfs_volume.open(filename, mode)
fsntfs_volume.close()
except Exception as exception:
print(str(exception))
result = False
if not result:
print("(FAIL)")
else:
print("(PASS)")
return result
def test_open(self):
"""Tests the open function."""
if not unittest.source:
raise unittest.SkipTest("missing source")
if unittest.offset:
raise unittest.SkipTest("source defines offset")
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open(unittest.source)
with self.assertRaises(IOError):
fsntfs_volume.open(unittest.source)
fsntfs_volume.close()
with self.assertRaises(TypeError):
fsntfs_volume.open(None)
with self.assertRaises(ValueError):
fsntfs_volume.open(unittest.source, mode="w")
def test_open_file_object(self):
"""Tests the open_file_object function."""
if not unittest.source:
return
file_object = open(unittest.source, "rb")
fsntfs_volume = pyfsntfs.volume()
fsntfs_volume.open_file_object(file_object)
# TODO: fix.
with self.assertRaises(MemoryError):
fsntfs_volume.open_file_object(file_object)
fsntfs_volume.close()
# TODO: change IOError into TypeError
with self.assertRaises(IOError):
fsntfs_volume.open_file_object(None)
with self.assertRaises(ValueError):
fsntfs_volume.open_file_object(file_object, mode="w")
def __init__(self,
base_fd: Optional[vfs_base.VFSHandler],
handlers: Dict[Any, Type[vfs_base.VFSHandler]],
pathspec: Optional[rdf_paths.PathSpec] = None,
progress_callback: Optional[Callable[[], None]] = None):
super().__init__(base_fd,
handlers=handlers,
pathspec=pathspec,
progress_callback=progress_callback)
# self.pathspec is initialized to a copy of base_fd
if base_fd is None:
raise ValueError("NTFS driver must have a file base.")
elif isinstance(base_fd, NTFSFile) and base_fd.IsDirectory():
self.volume = base_fd.volume
last_path = utils.JoinPath(self.pathspec.last.path, pathspec.path)
# Replace the last component with this one.
self.pathspec.Pop(-1)
self.pathspec.Append(pathspec)
self.pathspec.last.path = last_path
elif not base_fd.IsDirectory():
cache_key = base_fd.pathspec.SerializeToBytes()
try:
self.volume = MOUNT_CACHE.Get(cache_key)
except KeyError:
self.volume = pyfsntfs.volume()
self.volume.open_file_object(base_fd)
MOUNT_CACHE.Put(cache_key, self.volume)
self.pathspec.Append(pathspec)
elif base_fd.IsDirectory():
raise IOError("Base must be a file.")
self.fd = None
self.data_stream = None
# Try to open by "inode" number.
if pathspec is not None and pathspec.HasField("inode"):
# The lower 48 bits of the file_reference are the MFT index.
mft_index = pathspec.inode & ((1 << 48) - 1)
self.fd = self.volume.get_file_entry(mft_index)
# If the file_reference changed, then the MFT entry points now to
# a different file. Reopen it by path.
if self.fd is not None and self.fd.file_reference != pathspec.inode:
self.fd = None
# Try to open by path
if self.fd is None:
path = self.pathspec.last.path
path = path.replace("/", "\\")
self.fd = self.volume.get_file_entry_by_path(path)
if self.fd is None:
raise IOError("Failed to open {}".format(path))
# Determine data stream
if pathspec is not None and pathspec.HasField("stream_name"):
if pathspec.path_options == rdf_paths.PathSpec.Options.CASE_LITERAL:
self.data_stream = self.fd.get_alternate_data_stream_by_name(
pathspec.stream_name)
else:
self.data_stream = _GetAlternateDataStreamCaseInsensitive(
self.fd, pathspec.stream_name)
if self.data_stream is None:
raise IOError("Failed to open data stream {} in {}.".format(
pathspec.stream_name, path))
self.pathspec.last.stream_name = self.data_stream.name
else:
if self.fd.has_default_data_stream():
self.data_stream = self.fd
# self.pathspec will be used for future access to this file.
# The name is now literal, so disable case-insensitive lookup (expensive).
self.pathspec.last.path_options = rdf_paths.PathSpec.Options.CASE_LITERAL
# Access the file by file_reference, to skip path lookups.
self.pathspec.last.inode = self.fd.file_reference
if not self.IsDirectory():
if self.data_stream is not None:
self.size = self.data_stream.get_size()
else:
self.size = 0
def __init__(self, device: filesystem.Device):
super().__init__(device)
self.volume = pyfsntfs.volume()
self.volume.open_file_object(DeviceWrapper(self))
def test_close(self):
"""Tests the close function."""
if not unittest.source:
return
fsntfs_volume = pyfsntfs.volume()
