How to use the dfvfs.path.ntfs_path_spec.NTFSPathSpec function in dfvfs

To help you get started, we’ve selected a few dfvfs examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github log2timeline / dfvfs / tests / vfs / ntfs_file_entry.py View on Github external
def testIsFile(self):
    """Test the IsFile function."""
    test_location = (
        '\\System Volume Information\\{3808876b-c176-4e48-b7ae-04046e6cc752}')
    path_spec = ntfs_path_spec.NTFSPathSpec(
        location=test_location, mft_entry=38, parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)

    self.assertIsNotNone(file_entry)
    self.assertTrue(file_entry.IsFile())

    path_spec = ntfs_path_spec.NTFSPathSpec(
        location='\\System Volume Information', mft_entry=36,
        parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)

    self.assertIsNotNone(file_entry)
    self.assertFalse(file_entry.IsFile())

    path_spec = ntfs_path_spec.NTFSPathSpec(
        location='\\', parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)

    self.assertIsNotNone(file_entry)
    self.assertFalse(file_entry.IsFile())
github log2timeline / dfvfs / tests / vfs / ntfs_file_entry.py View on Github external
def testName(self):
    """Test the name property."""
    path_spec = ntfs_path_spec.NTFSPathSpec(
        mft_attribute=1, mft_entry=41, parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)

    data_streams = list(file_entry.data_streams)
    self.assertNotEqual(len(data_streams), 0)

    self.assertEqual(data_streams[0].name, '')
github log2timeline / dfvfs / tests / vfs / ntfs_file_system.py View on Github external
def setUp(self):
    """Sets up the needed objects used throughout the test."""
    self._resolver_context = context.Context()
    test_file = self._GetTestFilePath(['vsstest.qcow2'])
    self._SkipIfPathNotExists(test_file)

    path_spec = os_path_spec.OSPathSpec(location=test_file)
    self._qcow_path_spec = qcow_path_spec.QCOWPathSpec(parent=path_spec)
    self._ntfs_path_spec = ntfs_path_spec.NTFSPathSpec(
        location='\\', parent=self._qcow_path_spec)
github log2timeline / dfvfs / tests / vfs / ntfs_file_entry.py View on Github external
def testIsDefault(self):
    """Test the IsDefault function."""
    path_spec = ntfs_path_spec.NTFSPathSpec(
        mft_attribute=1, mft_entry=41, parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)

    data_streams = list(file_entry.data_streams)
    self.assertNotEqual(len(data_streams), 0)

    self.assertTrue(data_streams[0].IsDefault())
github log2timeline / dfvfs / tests / path / ntfs_path_spec.py View on Github external
path_spec = ntfs_path_spec.NTFSPathSpec(
        location='\\test', mft_entry=1, parent=self._path_spec)

    self.assertIsNotNone(path_spec)

    with self.assertRaises(ValueError):
      ntfs_path_spec.NTFSPathSpec(location='\\test', parent=None)

    with self.assertRaises(ValueError):
      ntfs_path_spec.NTFSPathSpec(location=None, parent=self._path_spec)

    with self.assertRaises(ValueError):
      ntfs_path_spec.NTFSPathSpec(mft_entry=None, parent=self._path_spec)

    with self.assertRaises(ValueError):
      ntfs_path_spec.NTFSPathSpec(
          location='\\test', parent=self._path_spec, bogus='BOGUS')
github log2timeline / dfvfs / tests / vfs / ntfs_file_entry.py View on Github external
def testAttributes(self):
    """Test the attributes properties."""
    test_location = (
        '\\System Volume Information\\{3808876b-c176-4e48-b7ae-04046e6cc752}')
    path_spec = ntfs_path_spec.NTFSPathSpec(
        location=test_location, mft_entry=38, parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)
    self.assertIsNotNone(file_entry)

    self.assertEqual(file_entry.number_of_attributes, 4)

    attributes = list(file_entry.attributes)
    attribute = attributes[0]

    self.assertEqual(
        attribute.type_indicator,
        definitions.ATTRIBUTE_TYPE_NTFS_STANDARD_INFORMATION)

    self.assertIsNotNone(attribute.access_time)
    self.assertIsNotNone(attribute.creation_time)
    self.assertIsNotNone(attribute.modification_time)
github log2timeline / dfvfs / tests / file_io / ntfs_file_io.py View on Github external
def testOpenCloseMFTEntry(self):
    """Test the open and close functionality using a MFT entry."""
    path_spec = ntfs_path_spec.NTFSPathSpec(
        mft_attribute=1, mft_entry=self._MFT_ENTRY_PASSWORDS_TXT,
        parent=self._os_path_spec)
    file_object = ntfs_file_io.NTFSFile(self._resolver_context)

    self._TestOpenCloseMFTEntry(path_spec, file_object)
github log2timeline / dfvfs / tests / vfs / ntfs_file_entry.py View on Github external
path_spec = ntfs_path_spec.NTFSPathSpec(
        location=test_location, mft_entry=38, parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)

    self.assertIsNotNone(file_entry)
    self.assertFalse(file_entry.IsDevice())

    path_spec = ntfs_path_spec.NTFSPathSpec(
        location='\\System Volume Information', mft_entry=36,
        parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)

    self.assertIsNotNone(file_entry)
    self.assertFalse(file_entry.IsDevice())

    path_spec = ntfs_path_spec.NTFSPathSpec(
        location='\\', parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)

    self.assertIsNotNone(file_entry)
    self.assertFalse(file_entry.IsDevice())
github log2timeline / dfvfs / tests / vfs / ntfs_file_entry.py View on Github external
def testChangeTime(self):
    """Test the change_time property."""
    path_spec = ntfs_path_spec.NTFSPathSpec(
        mft_attribute=1, mft_entry=41, parent=self._qcow_path_spec)
    file_entry = self._file_system.GetFileEntryByPathSpec(path_spec)

    self.assertIsNotNone(file_entry)
    self.assertIsNotNone(file_entry.change_time)
github log2timeline / dfvfs / dfvfs / vfs / ntfs_file_entry.py View on Github external
self._fsntfs_file_entry.get_parent_file_reference_by_attribute_index(
              mft_attribute))
    else:
      parent_file_reference = (
          self._fsntfs_file_entry.get_parent_file_reference())

    if parent_file_reference is None:
      return None

    parent_mft_entry = (
        parent_file_reference & _FILE_REFERENCE_MFT_ENTRY_BITMASK)

    parent_path_spec = getattr(self.path_spec, 'parent', None)
    # TODO: determine and pass the mft_attribute of the parent
    # for a faster resolve of the file entry.
    path_spec = ntfs_path_spec.NTFSPathSpec(
        location=parent_location, mft_entry=parent_mft_entry,
        parent=parent_path_spec)

    # TODO: handle parent correctly use attribute index?
    is_root = bool(
        parent_location == self._file_system.LOCATION_ROOT or
        parent_mft_entry == self._file_system.MFT_ENTRY_ROOT_DIRECTORY)

    return NTFSFileEntry(
        self._resolver_context, self._file_system, path_spec, is_root=is_root)