How to use the turbinia.evidence.RawDisk function in turbinia

To help you get started, we’ve selected a few turbinia examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github google / turbinia / tests / evidence.py View on Github external
def testEvidenceSerialization(self):
    """Test that evidence serializes/unserializes."""
    rawdisk = evidence.RawDisk(
        name='My Evidence', local_path='/tmp/foo', mount_path='/mnt/foo')
    rawdisk_json = rawdisk.to_json()
    self.assertTrue(isinstance(rawdisk_json, str))

    rawdisk_new = evidence.evidence_decode(json.loads(rawdisk_json))
    self.assertTrue(isinstance(rawdisk_new, evidence.RawDisk))
    self.assertEqual(rawdisk_new.name, 'My Evidence')
    self.assertEqual(rawdisk_new.mount_path, '/mnt/foo')
github google / turbinia / tests / pubsub.py View on Github external
def getTurbiniaRequest():
  """Get a Turbinia Request object with valid evidence attached.

  Returns:
    TurbiniaRequest object.
  """
  request = message.TurbiniaRequest(
      request_id='deadbeef', context={'kw': [1, 2]})
  rawdisk = evidence.RawDisk(
      name='My Evidence', local_path='/tmp/foo', mount_path='/mnt/foo')
  request.evidence.append(rawdisk)
  return request
github google / turbinia / tests / pubsub.py View on Github external
def testTurbiniaRequestSerializationBadJSON(self):
    """Tests that TurbiniaRequest will raise error on wrong JSON object."""
    rawdisk = evidence.RawDisk(name='My Evidence', local_path='/tmp/foo')
    rawdisk_json = rawdisk.to_json()
    self.assertTrue(isinstance(rawdisk_json, str))

    request_new = message.TurbiniaRequest()
    # Try to load serialization RawDisk() into a TurbiniaRequest, which should
    # error because this is not the correct type.
    self.assertRaises(TurbiniaException, request_new.from_json, rawdisk_json)
github google / turbinia / turbinia / evidence.py View on Github external
def __init__(self, mount_partition=1, size=None, *args, **kwargs):
    """Initialization for raw disk evidence object."""

    if mount_partition < 1:
      raise TurbiniaException(
          'Partition numbers start at 1, but was given {0:d}'.format(
              mount_partition))

    self.device_path = None
    self.mount_partition = mount_partition
    self.size = size
    super(RawDisk, self).__init__(*args, **kwargs)
github google / turbinia / turbinia / evidence.py View on Github external
self.size = size
    super(RawDisk, self).__init__(*args, **kwargs)

  def _preprocess(self, _):
    self.device_path, partition_paths = mount_local.PreprocessLosetup(
        self.source_path)
    self.mount_path = mount_local.PreprocessMountDisk(
        partition_paths, self.mount_partition)
    self.local_path = self.device_path

  def _postprocess(self):
    mount_local.PostprocessUnmountPath(self.mount_path)
    mount_local.PostprocessDeleteLosetup(self.device_path)


class EncryptedDisk(RawDisk):
  """Encrypted disk file evidence.

  Attributes:
    encryption_type: The type of encryption used, e.g. FileVault or Bitlocker.
    encryption_key: A string of the encryption key used for this disk.
    unencrypted_path: A string to the unencrypted local path
  """

  def __init__(
      self, encryption_type=None, encryption_key=None, unencrypted_path=None,
      *args, **kwargs):
    """Initialization for Encrypted disk evidence objects."""
    # TODO(aarontp): Make this an enum, or limited list
    self.encryption_type = encryption_type
    self.encryption_key = encryption_key
    # self.local_path will be the encrypted path