def testParse(self):
"""Tests the Parse function."""
parser = esedb.ESEDBParser()
storage_writer = self._ParseFile(['Windows.edb'], parser)
# Extensible Storage Engine Database information:
# File type: Database
# Created in format: 0x620,17
# Current format: 0x620,17
# Page size: 32768 bytes
self.assertEqual(storage_writer.number_of_events, 0)
self.assertEqual(storage_writer.number_of_extraction_warnings, 0)
self.assertEqual(storage_writer.number_of_recovery_warnings, 0)
session = sessions.Session()
storage_writer = self._CreateStorageWriter()
parser_mediator = self._CreateParserMediator(session, storage_writer)
parser = esedb.ESEDBParser()
parser.ParseFileObject(parser_mediator, None)
self.assertEqual(storage_writer.number_of_events, 0)
self.assertEqual(storage_writer.number_of_extraction_warnings, 1)
self.assertEqual(storage_writer.number_of_recovery_warnings, 0)
generator = storage_writer.GetAttributeContainers(
warnings.ExtractionWarning.CONTAINER_TYPE)
test_warnings = list(generator)
test_warning = test_warnings[0]
self.assertIsNotNone(test_warning)
expected_message = 'unable to open file with error: Missing file object.'
self.assertEqual(test_warning.message, expected_message)
def testParse(self):
"""Tests the Parse function."""
parser = esedb.ESEDBParser()
storage_writer = self._ParseFile(['Windows.edb'], parser)
# Extensible Storage Engine Database information:
# File type: Database
# Created in format: 0x620,17
# Current format: 0x620,17
# Page size: 32768 bytes
self.assertEqual(storage_writer.number_of_warnings, 0)
self.assertEqual(storage_writer.number_of_events, 0)
storage_writer = self._CreateStorageWriter()
parser_mediator = self._CreateParserMediator(storage_writer)
parser = esedb.ESEDBParser()
parser.ParseFileObject(parser_mediator, None)
self.assertEqual(storage_writer.number_of_warnings, 1)
self.assertEqual(storage_writer.number_of_events, 0)
warnings = list(storage_writer.GetWarnings())
warning = warnings[0]
self.assertIsNotNone(warning)
self.assertTrue(warning.message.startswith(
'unable to open file with error: pyesedb_file_open_file_object: '))
def testParse(self):
"""Tests the Parse function."""
parser_object = esedb.ESEDBParser()
storage_writer = self._ParseFile([u'Windows.edb'], parser_object)
# Extensible Storage Engine Database information:
# File type: Database
# Created in format: 0x620,17
# Current format: 0x620,17
# Page size: 32768 bytes
self.assertEqual(len(storage_writer.events), 0)
self.assertEqual(len(storage_writer.errors), 0)
storage_writer = self._CreateStorageWriter()
parser_mediator = self._CreateParserMediator(storage_writer)
parser_object = esedb.ESEDBParser()
parser_object.ParseFileObject(parser_mediator, None)
self.assertEqual(len(storage_writer.events), 0)
self.assertEqual(len(storage_writer.errors), 1)
error = storage_writer.errors[0]
self.assertIsNotNone(error)
self.assertTrue(error.message.startswith(
u'unable to open file with error: pyesedb_file_open_file_object: '))
def testEnablePlugins(self):
"""Tests the EnablePlugins function."""
parser = esedb.ESEDBParser()
number_of_plugins = len(parser._plugin_classes)
parser.EnablePlugins([])
self.assertEqual(len(parser._plugins), 0)
parser.EnablePlugins(parser.ALL_PLUGINS)
self.assertEqual(len(parser._plugins), number_of_plugins)
parser.EnablePlugins(['file_history'])
self.assertEqual(len(parser._plugins), 1)