WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Tests: Fix MFTScan testdata

Browse Source 
These test values needed updating now that the `LayerData` type is used
and presents the data a little differently than before.
This commit is contained in:
David McDonald
2025-04-02 14:08:18 -05:00
parent e446c1081d
commit 5befbf8629
1 changed files with 20 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/plugins/windows/windows.py
+20 -17
View File
@@ -1,10 +1,10 @@
import json
import hashlib
import shutil
import contextlib
import tempfile
import hashlib
import json
import os
from test import test_volatility, WindowsSamples
import shutil
import tempfile
from test import WindowsSamples, test_volatility
class TestWindowsVolshell:
@@ -843,20 +843,22 @@ class TestWindowsMFTscan:
{
"ADS Filename": "Zone.Identifier",
"Filename": "libby_hoeler_part1.wmv",
"Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a ZoneId=3.. "',
"Hexdump": "5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a 5a 6f 6e 65 49 64 3d 33 0d 0a",
"MFT Type": "DATA",
"Offset": 55926304,
"Record Number": 323,
"Record Type": "FILE",
"__children": [],
},
{
"ADS Filename": "Zone.Identifier",
"Filename": "NetZeroQuickHelpLite.exe",
"Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a ZoneId=3.. "',
"Hexdump": "5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a 5a 6f 6e 65 49 64 3d 33 0d 0a",
"MFT Type": "DATA",
"Offset": 56102400,
"Record Number": 347,
"Record Type": "FILE",
"__children": [],
},
]
for expected_row in expected_rows:
@@ -877,20 +879,22 @@ class TestWindowsMFTscan:
{
"ADS Filename": "$Max",
"Filename": "$UsnJrnl",
"Hexdump": '"\n00 00 00 02 00 00 00 00 00 00 80 00 00 00 00 00 ................\nb9 dd f0 cc df 73 db 01 00 00 00 00 00 00 00 00 .....s.........."',
"Hexdump": "00 00 00 02 00 00 00 00 00 00 80 00 00 00 00 00 b9 dd f0 cc df 73 db 01 00 00 00 00 00 00 00 00",
"MFT Type": "DATA",
"Offset": 1058018088,
"Offset": 26235616,
"Record Number": 107240,
"Record Type": "FILE",
"__children": [],
},
{
"ADS Filename": "$Config",
"Filename": "$Repair",
"Hexdump": '"\n01 00 00 00 03 00 00 00 ........ "',
"ADS Filename": "$SRAT",
"Filename": "$Bitmap",
"Hexdump": "a4 5f fd 60 38 00 01 03 10 00 0c 00 04 00 00 00 01 00 00 00 01 00 00 00 8d 4e 16 00 02 00 00 00 a0 00 00 00 00 00 06 00 03 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4a 7b 01 00 00 00 00 00",
"MFT Type": "DATA",
"Offset": 5009678688,
"Record Number": 28,
"Offset": 1052277088,
"Record Number": 6,
"Record Type": "FILE",
"__children": [],
},
]
for expected_row in expected_rows:
@@ -924,7 +928,7 @@ class TestWindowsMFTscan:
expected_rows = [
{
"Filename": "index",
"Hexdump": '"\n30 5c 72 a7 1b 6d fb fc 09 00 00 00 00 00 00 00 0\\r..m..........\n00 00 00 00 00 00 00 00 ........ "',
"Hexdump": "30 5c 72 a7 1b 6d fb fc 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
"MFT Type": "DATA",
"Offset": 4961536280,
"Record Number": 116474,
@@ -932,7 +936,7 @@ class TestWindowsMFTscan:
},
{
"Filename": "0.2.filtertrie.intermediate.txt",
"Hexdump": '"\n30 09 32 0d 0a 0.2.. "',
"Hexdump": "30 09 32 0d 0a",
"MFT Type": "DATA",
"Offset": 619242944,
"Record Number": 113013,
@@ -1411,4 +1415,3 @@ class TestWindowsVirtMap:
)
for expected_row in expected_rows:
assert test_volatility.match_output_row(expected_row, json_out)