dissect.target 3.19.dev43__tar.gz → 3.19.dev45__tar.gz

{dissect_target-3.19.dev43/dissect.target.egg-info → dissect_target-3.19.dev45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev43
+Version: 3.19.dev45
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect_target-3.19.dev45/dissect/target/plugins/apps/texteditor/texteditor.py

@@ -0,0 +1,13 @@
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.plugin import NamespacePlugin
+
+GENERIC_TAB_CONTENTS_RECORD_FIELDS = [("string", "content"), ("path", "path"), ("string", "deleted_content")]
+
+TexteditorTabContentRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+    "texteditor/tab", GENERIC_TAB_CONTENTS_RECORD_FIELDS
+)
+
+
+class TexteditorPlugin(NamespacePlugin):
+    __namespace__ = "texteditor"

dissect_target-3.19.dev45/dissect/target/plugins/apps/texteditor/windowsnotepad.py

@@ -0,0 +1,340 @@
+from __future__ import annotations
+
+import logging
+import zlib
+from typing import Iterator
+
+from dissect.cstruct import cstruct
+from dissect.util.ts import wintimestamp
+from flow.record.fieldtypes import digest
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.helpers.record import (
+    UnixUserRecord,
+    WindowsUserRecord,
+    create_extended_descriptor,
+)
+from dissect.target.plugin import export
+from dissect.target.plugins.apps.texteditor.texteditor import (
+    GENERIC_TAB_CONTENTS_RECORD_FIELDS,
+    TexteditorPlugin,
+)
+from dissect.target.target import Target
+
+# Thanks to @Nordgaren, @daddycocoaman, @JustArion and @ogmini for their suggestions and feedback in the PR
+# thread. This really helped to figure out the last missing bits and pieces
+# required for recovering text from these files.
+
+windowstab_def = """
+struct file_header {
+    char        magic[2]; // NP
+    uleb128     updateNumber; // increases on every settings update when fileType=9,
+                              // doesn't seem to change on fileType 0 or 1
+    uleb128     fileType; // 0 if unsaved, 1 if saved, 9 if contains settings?
+}
+
+struct tab_header_saved {
+    uleb128     filePathLength;
+    wchar       filePath[filePathLength];
+    uleb128     fileSize; // likely similar to fixedSizeBlockLength
+    uleb128     encoding;
+    uleb128     carriageReturnType;
+    uleb128     timestamp; // Windows Filetime format (not unix timestamp)
+    char        sha256[32];
+    char        unk0;
+    char        unk1;
+    uleb128     fixedSizeBlockLength;
+    uleb128     fixedSizeBlockLengthDuplicate;
+    uint8       wordWrap; // 1 if wordwrap enabled, 0 if disabled
+    uint8       rightToLeft;
+    uint8       showUnicode;
+    uint8       optionsVersion;
+};
+
+struct tab_header_unsaved {
+    char        unk0;
+    uleb128     fixedSizeBlockLength; // will always be 00 when unsaved because size is not yet known
+    uleb128     fixedSizeBlockLengthDuplicate; // will always be 00 when unsaved because size is not yet known
+    uint8       wordWrap; // 1 if wordwrap enabled, 0 if disabled
+    uint8       rightToLeft;
+    uint8       showUnicode;
+    uint8       optionsVersion;
+};
+
+struct tab_header_crc32_stub {
+    char        unk1;
+    char        unk2;
+    char        crc32[4];
+};
+
+struct fixed_size_data_block {
+    uleb128     nAdded;
+    wchar       data[nAdded];
+    uint8       hasRemainingVariableDataBlocks; // indicates whether after this single-data block more data will follow
+    char        crc32[4];
+};
+
+struct variable_size_data_block {
+    uleb128     offset;
+    uleb128     nDeleted;
+    uleb128     nAdded;
+    wchar       data[nAdded];
+    char        crc32[4];
+};
+
+struct options_v1 {
+    uleb128     unk;
+};
+
+struct options_v2 {
+    uleb128     unk1; // likely autocorrect or spellcheck
+    uleb128     unk2; // likely autocorrect or spellcheck
+};
+"""
+
+WINDOWS_SAVED_TABS_EXTRA_FIELDS = [("datetime", "modification_time"), ("digest", "hashes"), ("path", "saved_path")]
+
+WindowsNotepadUnsavedTabRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+    "texteditor/windowsnotepad/tab/unsaved",
+    GENERIC_TAB_CONTENTS_RECORD_FIELDS,
+)
+
+WindowsNotepadSavedTabRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+    "texteditor/windowsnotepad/tab/saved",
+    GENERIC_TAB_CONTENTS_RECORD_FIELDS + WINDOWS_SAVED_TABS_EXTRA_FIELDS,
+)
+
+c_windowstab = cstruct().load(windowstab_def)
+
+
+def _calc_crc32(data: bytes) -> bytes:
+    """Perform a CRC32 checksum on the data and return it as bytes."""
+    return zlib.crc32(data).to_bytes(length=4, byteorder="big")
+
+
+class WindowsNotepadTab:
+    """Windows notepad tab content parser"""
+
+    def __init__(self, file: TargetPath):
+        self.file = file
+        self.is_saved = None
+        self.content = None
+        self.deleted_content = None
+        self._process_tab_file()
+
+    def __repr__(self) -> str:
+        return (
+            f"<{self.__class__.__name__} saved={self.is_saved} "
+            f"content_size={len(self.content)} has_deleted_content={self.deleted_content is not None}>"
+        )
+
+    def _process_tab_file(self) -> None:
+        """Parse a binary tab file and reconstruct the contents."""
+        with self.file.open("rb") as fh:
+            # Header is the same for all types
+            self.file_header = c_windowstab.file_header(fh)
+
+            # fileType == 1  # 0 is unsaved, 1 is saved, 9 is settings?
+            self.is_saved = self.file_header.fileType == 1
+
+            # Tabs can be saved to a file with a filename on disk, or unsaved (kept in the TabState folder).
+            # Depending on the file's saved state, different header fields are present
+            self.tab_header = (
+                c_windowstab.tab_header_saved(fh) if self.is_saved else c_windowstab.tab_header_unsaved(fh)
+            )
+
+            # There appears to be a optionsVersion field that specifies the options that are passed.
+            # At the moment of writing, it is not sure whether this specifies a version or a number of bytes
+            # that is parsed, so just going with the 'optionsVersion' type for now.
+            # We don't use the options, but since they are required for the CRC32 checksum
+            # we store the byte representation
+            if self.tab_header.optionsVersion == 0:
+                # No options specified
+                self.options = b""
+            elif self.tab_header.optionsVersion == 1:
+                self.options = c_windowstab.options_v1(fh).dumps()
+            elif self.tab_header.optionsVersion == 2:
+                self.options = c_windowstab.options_v2(fh).dumps()
+            else:
+                # Raise an error, since we don't know how many bytes future optionVersions will occupy.
+                # Now knowing how many bytes to parse can mess up the alignment and structs.
+                raise NotImplementedError("Unknown Windows Notepad tab option version")
+
+            # If the file is not saved to disk and no fixedSizeBlockLength is present, an extra checksum stub
+            # is present. So parse that first
+            if not self.is_saved and self.tab_header.fixedSizeBlockLength == 0:
+                # Two unknown bytes before the CRC32
+                tab_header_crc32_stub = c_windowstab.tab_header_crc32_stub(fh)
+
+                # Calculate CRC32 of the header and check if it matches
+                actual_header_crc32 = _calc_crc32(
+                    self.file_header.dumps()[3:]
+                    + self.tab_header.dumps()
+                    + self.options
+                    + tab_header_crc32_stub.dumps()[:-4]
+                )
+                if tab_header_crc32_stub.crc32 != actual_header_crc32:
+                    logging.warning(
+                        "CRC32 mismatch in header of file: %s (expected=%s, actual=%s)",
+                        self.file.name,
+                        tab_header_crc32_stub.crc32.hex(),
+                        actual_header_crc32.hex(),
+                    )
+
+            # Used to store the final content
+            self.content = ""
+
+            # In the case that a fixedSizeDataBlock is present, this value is set to a nonzero value
+            if self.tab_header.fixedSizeBlockLength > 0:
+                # So we parse the fixed size data block
+                self.data_entry = c_windowstab.fixed_size_data_block(fh)
+
+                # The header (minus the magic) plus all data is included in the checksum
+                actual_crc32 = _calc_crc32(
+                    self.file_header.dumps()[3:] + self.tab_header.dumps() + self.options + self.data_entry.dumps()[:-4]
+                )
+
+                if self.data_entry.crc32 != actual_crc32:
+                    logging.warning(
+                        "CRC32 mismatch in single-block file: %s (expected=%s, actual=%s)",
+                        self.file.name,
+                        self.data_entry.crc32.hex(),
+                        actual_crc32.hex(),
+                    )
+
+                # Add the content of the fixed size data block to the tab content
+                self.content += self.data_entry.data
+
+            # Used to store the deleted content, if available
+            deleted_content = ""
+
+            # If fixedSizeBlockLength in the header has a value of zero, this means that the entire file consists of
+            # variable-length blocks. Furthermore, if there is any remaining data after the
+            # first fixed size blocks, as indicated by the value of hasRemainingVariableDataBlocks,
+            # also continue we also want to continue parsing
+            if self.tab_header.fixedSizeBlockLength == 0 or (
+                self.tab_header.fixedSizeBlockLength > 0 and self.data_entry.hasRemainingVariableDataBlocks == 1
+            ):
+                # Here, data is stored in variable-length blocks. This happens, for example, when several
+                # additions and deletions of characters have been recorded and these changes have not been 'flushed'
+
+                # Since we don't know the size of the file up front, and offsets don't necessarily have to be in order,
+                # a list is used to easily insert text at offsets
+                text = []
+
+                while True:
+                    # Unfortunately, there is no way of determining how many blocks there are. So just try to parse
+                    # until we reach EOF, after which we stop.
+                    try:
+                        data_entry = c_windowstab.variable_size_data_block(fh)
+                    except EOFError:
+                        break
+
+                    # Either the nAdded is nonzero, or the nDeleted
+                    if data_entry.nAdded > 0:
+                        # Check the CRC32 checksum for this block
+                        actual_crc32 = _calc_crc32(data_entry.dumps()[:-4])
+                        if data_entry.crc32 != actual_crc32:
+                            logging.warning(
+                                "CRC32 mismatch in multi-block file: %s (expected=%s, actual=%s)",
+                                self.file.name,
+                                data_entry.crc32.hex(),
+                                actual_crc32.hex(),
+                            )
+
+                        # Insert the text at the correct offset.
+                        for idx in range(data_entry.nAdded):
+                            text.insert(data_entry.offset + idx, data_entry.data[idx])
+
+                    elif data_entry.nDeleted > 0:
+                        # Create a new slice. Include everything up to the offset,
+                        # plus everything after the nDeleted following bytes
+                        deleted_content += "".join(text[data_entry.offset : data_entry.offset + data_entry.nDeleted])
+                        text = text[: data_entry.offset] + text[data_entry.offset + data_entry.nDeleted :]
+
+                # Join all the characters to reconstruct the original text within the variable-length data blocks
+                text = "".join(text)
+
+                # Finally, add the reconstructed text to the tab content
+                self.content += text
+
+        # Set None if no deleted content was found
+        self.deleted_content = deleted_content if deleted_content else None
+
+
+class WindowsNotepadPlugin(TexteditorPlugin):
+    """Windows notepad tab content plugin."""
+
+    __namespace__ = "windowsnotepad"
+
+    GLOB = "AppData/Local/Packages/Microsoft.WindowsNotepad_*/LocalState/TabState/*.bin"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.users_tabs: list[TargetPath, UnixUserRecord | WindowsUserRecord] = []
+        for user_details in self.target.user_details.all_with_home():
+            for tab_file in user_details.home_path.glob(self.GLOB):
+                # These files seem to contain information on different settings / configurations,
+                # and are skipped for now
+                if tab_file.name.endswith(".1.bin") or tab_file.name.endswith(".0.bin"):
+                    continue
+
+                self.users_tabs.append((tab_file, user_details.user))
+
+    def check_compatible(self) -> None:
+        if not self.users_tabs:
+            raise UnsupportedPluginError("No Windows Notepad tab files found")
+
+    @export(record=[WindowsNotepadSavedTabRecord, WindowsNotepadUnsavedTabRecord])
+    def tabs(self) -> Iterator[WindowsNotepadSavedTabRecord | WindowsNotepadUnsavedTabRecord]:
+        """Return contents from Windows 11 Notepad tabs - and its deleted content if available.
+
+        Windows Notepad application for Windows 11 is now able to restore both saved and unsaved tabs when you re-open
+        the application.
+
+
+        Resources:
+            - https://github.com/fox-it/dissect.target/pull/540
+            - https://github.com/JustArion/Notepad-Tabs
+            - https://github.com/ogmini/Notepad-Tabstate-Buffer
+            - https://github.com/ogmini/Notepad-State-Library
+            - https://github.com/Nordgaren/tabstate-util
+            - https://github.com/Nordgaren/tabstate-util/issues/1
+            - https://medium.com/@mahmoudsoheem/new-digital-forensics-artifact-from-windows-notepad-527645906b7b
+
+        Yields a WindowsNotepadSavedTabRecord or WindowsNotepadUnsavedTabRecord. with fields:
+
+        .. code-block:: text
+
+            content (string): The content of the tab.
+            path (path): The path to the tab file.
+            deleted_content (string): The deleted content of the tab, if available.
+            hashes (digest): A digest of the tab content.
+            saved_path (path): The path where the tab was saved.
+            modification_time (datetime): The modification time of the tab.
+        """
+        for file, user in self.users_tabs:
+            # Parse the file
+            tab: WindowsNotepadTab = WindowsNotepadTab(file)
+
+            if tab.is_saved:
+                yield WindowsNotepadSavedTabRecord(
+                    content=tab.content,
+                    path=tab.file,
+                    deleted_content=tab.deleted_content,
+                    hashes=digest((None, None, tab.tab_header.sha256.hex())),
+                    saved_path=tab.tab_header.filePath,
+                    modification_time=wintimestamp(tab.tab_header.timestamp),
+                    _target=self.target,
+                    _user=user,
+                )
+            else:
+                yield WindowsNotepadUnsavedTabRecord(
+                    content=tab.content,
+                    path=tab.file,
+                    _target=self.target,
+                    _user=user,
+                    deleted_content=tab.deleted_content,
+                )

{dissect_target-3.19.dev43 → dissect_target-3.19.dev45/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev43
+Version: 3.19.dev45
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev43 → dissect_target-3.19.dev45}/dissect.target.egg-info/SOURCES.txt

@@ -153,6 +153,9 @@ dissect/target/plugins/apps/ssh/openssh.py
 dissect/target/plugins/apps/ssh/opensshd.py
 dissect/target/plugins/apps/ssh/putty.py
 dissect/target/plugins/apps/ssh/ssh.py
+dissect/target/plugins/apps/texteditor/__init__.py
+dissect/target/plugins/apps/texteditor/texteditor.py
+dissect/target/plugins/apps/texteditor/windowsnotepad.py
 dissect/target/plugins/apps/vpn/__init__.py
 dissect/target/plugins/apps/vpn/openvpn.py
 dissect/target/plugins/apps/vpn/wireguard.py
@@ -462,6 +465,8 @@ tests/plugins/apps/ssh/__init__.py
 tests/plugins/apps/ssh/test_openssh.py
 tests/plugins/apps/ssh/test_opensshd.py
 tests/plugins/apps/ssh/test_putty.py
+tests/plugins/apps/texteditor/__init__.py
+tests/plugins/apps/texteditor/test_texteditor.py
 tests/plugins/apps/vpn/__init__.py
 tests/plugins/apps/vpn/test_openvpn.py
 tests/plugins/apps/vpn/test_wireguard.py

dissect_target-3.19.dev45/tests/plugins/apps/texteditor/test_texteditor.py

@@ -0,0 +1,190 @@
+import os
+from pathlib import Path
+
+from flow.record.fieldtypes import datetime as dt
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.apps.texteditor.windowsnotepad import (
+    WindowsNotepadPlugin,
+    WindowsNotepadTab,
+)
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+text1 = "This is an unsaved tab, UTF-8 encoded with Windows (CRLF). It's only 88 characters long."
+text2 = (
+    "Dissect は、インシデント対応のための優れたフレームワークです。 The Notepad window shows UTF-8 as the encoding. This text has 113 "
+    "characters."
+)
+text3 = "This is a very short text."
+text4 = "This is another short test. And we should be able to parse this."
+text5 = "This is a test and the text is longer than 256 bytes. "
+text6 = "This is a test and the text is longer than 65536 bytes. "
+text7 = (
+    "This a text, which is nothing special. But I am going to modify it a bit. For example, "
+    "I have removed quote some stuff. Adding a word in the beginning now... "
+    "At this point, I've edited it quite a lot."
+)
+text8 = (
+    "Closing application now. It's saved but now I'm adding unsaved changes and closing "
+    "the application again. Dit a few deletions!"
+)
+loremipsum = """Lorem ipsum dolor sit amet. Eum error blanditiis eum pariatur delectus ut consequuntur officiis a excepturi dignissimos et doloribus quia 33 perspiciatis soluta nam perspiciatis dolor. Ut repudiandae quidem cum sint modi qui sint consequatur. Aut autem quidem eum enim consequatur qui voluptate consequatur non similique voluptate. A vitae modi vel sint provident ut galisum tenetur sit voluptatem amet. Est impedit perspiciatis est repudiandae voluptates ut fugit alias! Eum magni esse aut velit illum qui excepturi aperiam. Ex dolores asperiores ut debitis omnis qui consequuntur dolore. Est voluptatem mollitia et quibusdam unde ea accusamus fuga. Cum quis galisum et impedit sunt qui aliquam perspiciatis sed modi quidem qui nisi molestias. Aut temporibus architecto ut neque voluptatem et consequatur deleniti sed accusantium quibusdam et omnis dignissimos ad rerum ipsam et rerum quia. Ut nihil repellat et eaque molestias quo iusto ipsum At optio sint eos quidem earum?\r\rEx deleniti unde eum tenetur rerum ea dolore numquam? Eos aperiam officiis et neque explicabo et enim atque ut eaque omnis non illum eveniet est molestias itaque et ratione voluptatem. Ea deserunt nemo et quos tempora et nostrum aperiam sit necessitatibus illo sit culpa placeat. Vel tempore quibusdam ut velit voluptate aut odio facere non voluptas earum est odio galisum et voluptas harum. Et blanditiis sapiente et nostrum laborum aut voluptatem explicabo a quasi assumenda. Est voluptatem quia eum minima galisum quo totam excepturi aut facilis enim vel voluptate repudiandae sit distinctio laboriosam. Quo possimus molestiae et molestiae accusantium est voluptas omnis sed obcaecati natus. Non vitae asperiores qui nostrum enim id saepe fugiat et incidunt quasi.\r\rEos ipsa facilis aut excepturi voluptatem a omnis magni vel magni iste. Sed ipsum consequatur qui reprehenderit deleniti et soluta molestiae. Ut vero assumenda id dolor ipsum in deleniti voluptatem aut quis quisquam sed repudiandae temporibus ab quia inventore. Sed velit fugit vel facere cumque et delectus ullam sed eaque impedit. Est veritatis dignissimos aut doloribus dolorem vel pariatur repellendus sit nesciunt similique eum architecto quia. Ea expedita veritatis eum dolorem molestiae ut enim fugit aut beatae quibusdam. Aut voluptas natus in quidem deleniti aut animi iure est incidunt tenetur qui culpa maiores! Et nostrum quaerat qui consequatur consequatur aut aliquam atque aut praesentium rerum et consequuntur exercitationem. Non accusantium ipsa vel consectetur vitae ut magnam autem et natus rerum ut consectetur inventore est doloremque temporibus 33 dolores doloribus! Aut perferendis optio et nostrum repellendus et fugit itaque ut nisi neque sed sint quaerat. Aut placeat architecto et eius sapiente eum molestiae quam. Quo mollitia sapiente non Quis neque non tempora laudantium. Quo distinctio quos et molestias natus sit veritatis consequuntur aut repellendus neque a porro galisum cum numquam nesciunt et animi earum? Aut dolorum dolore non assumenda omnis et molestiae amet id sint vero est eligendi harum sit temporibus magnam aut ipsam quos.\r\r"""  # noqa: E501
+
+
+def test_windows_tab_parsing() -> None:
+    # Standalone parsing of tab files, so not using the plugin
+    tab_file = Path(absolute_path("_data/plugins/apps/texteditor/windowsnotepad/unsaved-with-deletions.bin"))
+    content = WindowsNotepadTab(tab_file)
+    assert content.content == "Not saved aasdflasd"
+    assert repr(content) == "<WindowsNotepadTab saved=False content_size=19 has_deleted_content=True>"
+
+
+def test_windows_tab_plugin_deleted_contents(
+    target_win: Target, fs_win: VirtualFilesystem, tmp_path: Path, target_win_users: Target
+) -> None:
+    file_text_map = {
+        "unsaved-with-deletions.bin": ("Not saved aasdflasd", "snUlltllafds tjkf"),
+        "lots-of-deletions.bin": (
+            "This a text, which is nothing special. But I am going to modify it a bit. "
+            "For example, I have removed quote some stuff. "
+            "Adding a word in the beginning now... "
+            "At this point, I've edited it quite a lot.",
+            "b a ,elpmac ydaerlae already thi laiceps emos",
+        ),
+    }
+
+    tabcache = absolute_path("_data/plugins/apps/texteditor/windowsnotepad/")
+
+    user = target_win_users.user_details.find(username="John")
+    tab_dir = user.home_path.joinpath(
+        "AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState"
+    )
+
+    fs_win.map_dir("Users\\John", tmp_path)
+
+    for file in file_text_map.keys():
+        tab_file = str(tab_dir.joinpath(file))[3:]
+        fs_win.map_file(tab_file, os.path.join(tabcache, file))
+
+    target_win.add_plugin(WindowsNotepadPlugin)
+
+    records = list(target_win.windowsnotepad.tabs())
+
+    # Check the amount of files
+    assert len(list(tab_dir.iterdir())) == len(file_text_map.keys())
+    assert len(records) == len(file_text_map.keys())
+
+    # The recovered content in the records should match the original data, as well as the length
+    for rec in records:
+        assert rec.content == file_text_map[rec.path.name][0]
+        assert rec.deleted_content == file_text_map[rec.path.name][1]
+
+
+def test_windows_tab_plugin_default(
+    target_win: Target, fs_win: VirtualFilesystem, tmp_path: Path, target_win_users: Target, caplog
+) -> None:
+    file_text_map = {
+        "c515e86f-08b3-4d76-844a-cddfcd43fcbb.bin": (text1, None),
+        "85167c9d-aac2-4469-ae44-db5dccf8f7f4.bin": (text2, None),
+        "dae80df8-e1e5-4996-87fe-b453f63fcb19.bin": (text3, "THis is "),
+        "3f915e17-cf6c-462b-9bd1-2f23314cb979.bin": (text4, None),
+        "ba291ccd-f1c3-4ca8-949c-c01f6633789d.bin": ((text5 * 5), None),
+        "e609218e-94f2-45fa-84e2-f29df2190b26.bin": ((text6 * 1260), None),
+        "3d0cc86e-dfc9-4f16-b74a-918c2c24188c.bin": (loremipsum, None),
+        "wrong-checksum.bin": (text4, None),  # only added to check for corrupt checksum, not validity
+        "cfe38135-9dca-4480-944f-d5ea0e1e589f.bin": (
+            (loremipsum * 37)[:-2],
+            None,
+        ),  # removed the two newlines in this file
+        "saved.bin": ("Saved!", None),
+        "unsaved.bin": ("Not saved at all", "snUllt"),
+        "unsaved-with-deletions.bin": ("Not saved aasdflasd", "snUlltllafds tjkf"),
+        "lots-of-deletions.bin": (text7, "b a ,elpmac ydaerlae already thi laiceps emos"),
+        "appclosed_saved_and_deletions.bin": (text8, None),
+        "appclosed_unsaved.bin": ("Closing application now", None),
+        "new-format.bin": ("", None),
+        "stored_unsaved_with_new_data.bin": ("Stored to disk but unsaved, but with extra data.", None),
+    }
+
+    tabcache = absolute_path("_data/plugins/apps/texteditor/windowsnotepad/")
+
+    user = target_win_users.user_details.find(username="John")
+    tab_dir = user.home_path.joinpath(
+        "AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState"
+    )
+
+    fs_win.map_dir("Users\\John", tmp_path)
+
+    for file in file_text_map.keys():
+        tab_file = str(tab_dir.joinpath(file))[3:]
+        fs_win.map_file(tab_file, os.path.join(tabcache, file))
+
+    target_win.add_plugin(WindowsNotepadPlugin)
+
+    records = list(target_win.windowsnotepad.tabs())
+
+    # Check the amount of files
+    assert len(list(tab_dir.iterdir())) == len(file_text_map.keys())
+    assert len(records) == len(file_text_map.keys())
+
+    for line in caplog.text.split("\n"):
+        # One file should still return contents, but there should be an entry for in the logging for a CRC missmatch.
+        assert (
+            "CRC32 mismatch in single-block file: wrong-checksum.bin (expected=deadbeef, actual=a48d30a6)" in line
+            or "CRC32 mismatch" not in line
+        )
+
+    # The recovered content in the records should match the original data, as well as the length
+    for rec in records:
+        assert rec.content == file_text_map[rec.path.name][0]
+        assert rec.deleted_content == file_text_map[rec.path.name][1]
+
+
+def test_windows_saved_tab_plugin_extra_fields(
+    target_win: Target, fs_win: VirtualFilesystem, tmp_path: Path, target_win_users: Target
+) -> None:
+    file_text_map = {
+        "saved.bin": (
+            "Saved!",
+            "C:\\Users\\user\\Desktop\\Saved!.txt",
+            dt(2024, 3, 28, 13, 7, 55, 482183),
+            "ed9b760289e614c9dc8776e7280abe870be0a85019a32220b35acc54c0ecfbc1",
+        ),
+        "appclosed_saved_and_deletions.bin": (
+            text8,
+            "C:\\Users\\user\\Desktop\\Saved.txt",
+            dt(2024, 3, 28, 13, 16, 21, 158279),
+            "8d0533144aa42e2d81e7474332bdef6473e42b699041528d55a62e5391e914ce",
+        ),
+    }
+
+    tabcache = absolute_path("_data/plugins/apps/texteditor/windowsnotepad/")
+
+    user = target_win_users.user_details.find(username="John")
+    tab_dir = user.home_path.joinpath(
+        "AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState"
+    )
+
+    fs_win.map_dir("Users\\John", tmp_path)
+
+    for file in file_text_map.keys():
+        tab_file = str(tab_dir.joinpath(file))[3:]
+        fs_win.map_file(tab_file, os.path.join(tabcache, file))
+
+    target_win.add_plugin(WindowsNotepadPlugin)
+
+    records = list(target_win.windowsnotepad.tabs())
+
+    # Check the amount of files
+    assert len(list(tab_dir.iterdir())) == len(file_text_map.keys())
+    assert len(records) == len(file_text_map.keys())
+
+    # The recovered content in the records should match the original data, as well as the length and all the
+    # other saved metadata
+    for rec in records:
+        assert len(rec.content) == len(file_text_map[rec.path.name][0])
+        assert rec.content == file_text_map[rec.path.name][0]
+        assert rec.saved_path == file_text_map[rec.path.name][1]
+        assert rec.modification_time == file_text_map[rec.path.name][2]
+        assert rec.hashes.sha256 == file_text_map[rec.path.name][3]