1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Tests for the file system event formatters."""
import unittest
from plaso.formatters import file_system
from tests.formatters import test_lib
class NTFSFileReferenceFormatterHelperTest(test_lib.EventFormatterTestCase):
"""Tests for the NTFS file reference formatter helper."""
def testFormatEventValues(self):
"""Tests the FormatEventValues function."""
formatter_helper = file_system.NTFSFileReferenceFormatterHelper()
output_mediator = self._CreateOutputMediator()
event_values = {'file_reference': 0x2000000000011 }
formatter_helper.FormatEventValues(output_mediator, event_values)
self.assertEqual(event_values['file_reference'], '17-2')
event_values = {'file_reference': None}
formatter_helper.FormatEventValues(output_mediator, event_values)
self.assertIsNone(event_values['file_reference'])
class NTFSParentFileReferenceFormatterHelperTest(
test_lib.EventFormatterTestCase):
"""Tests for the NTFS parent file reference formatter helper."""
def testFormatEventValues(self):
"""Tests the FormatEventValues function."""
formatter_helper = file_system.NTFSParentFileReferenceFormatterHelper()
output_mediator = self._CreateOutputMediator()
event_values = {'parent_file_reference': 0x2000000000011 }
formatter_helper.FormatEventValues(output_mediator, event_values)
self.assertEqual(event_values['parent_file_reference'], '17-2')
event_values = {'parent_file_reference': None}
formatter_helper.FormatEventValues(output_mediator, event_values)
self.assertIsNone(event_values['parent_file_reference'])
class NTFSPathHintsFormatterHelper(test_lib.EventFormatterTestCase):
"""Tests for the NTFS path hints formatter helper."""
def testFormatEventValues(self):
"""Tests the FormatEventValues function."""
formatter_helper = file_system.NTFSPathHintsFormatterHelper()
output_mediator = self._CreateOutputMediator()
event_values = {'path_hints': ['path1', 'path2']}
formatter_helper.FormatEventValues(output_mediator, event_values)
self.assertEqual(event_values['path_hints'], 'path1;path2')
event_values = {'path_hints': None}
formatter_helper.FormatEventValues(output_mediator, event_values)
self.assertIsNone(event_values['path_hints'])
if __name__ == '__main__':
unittest.main()
|
