dissect.target 3.20.dev12__tar.gz → 3.20.dev14__tar.gz

{dissect_target-3.20.dev12/dissect.target.egg-info → dissect_target-3.20.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev12
+Version: 3.20.dev14
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev12 → dissect_target-3.20.dev14}/dissect/target/plugins/filesystem/ntfs/mft.py

@@ -105,6 +105,7 @@ FilesystemMACBRecord = TargetRecordDescriptor(
         ("filesize", "filesize"),
         ("boolean", "resident"),
         ("boolean", "inuse"),
+        ("boolean", "ads"),
         ("string", "volume_uuid"),
     ],
 )
@@ -151,7 +152,7 @@ class MftPlugin(Plugin):
         "--macb",
         group="fmt",
         action="store_true",
-        help="compacts the MFT entry timestamps into aggregated records with MACB bitfield",
+        help="compacts MFT timestamps into MACB bitfield (format: MACB[standard|ads]/MACB[filename])",
     )
     def mft(
         self, compact: bool = False, fs: int | None = None, start: int = 0, end: int = -1, macb: bool = False
@@ -342,12 +343,13 @@ def macb_aggr(records: list[Record]) -> Iterator[Record]:
     for record in records:
         found = False
 
-        offset_std = int(record._desc.name == "filesystem/ntfs/mft/std") * 5
-        offset_ads = (int(record.ads) * 10) if offset_std == 0 else 0
+        offset = 0
+        if not getattr(record, "ads", False):
+            offset = int(record._desc.name == "filesystem/ntfs/mft/filename") * 5
 
-        field = "MACB".find(record.ts_type) + offset_std + offset_ads
+        field = "MACB".find(record.ts_type) + offset
         for macb in macbs:
-            if macb.ts == record.ts:
+            if macb.ts == record.ts and macb.path == record.path:
                 macb.macb = macb_set(macb.macb, field, record.ts_type)
                 found = True
                 break
@@ -356,7 +358,7 @@ def macb_aggr(records: list[Record]) -> Iterator[Record]:
             continue
 
         macb = FilesystemMACBRecord.init_from_record(record)
-        macb.macb = "..../..../...."
+        macb.macb = "..../...."
         macb.macb = macb_set(macb.macb, field, record.ts_type)
 
         macbs.append(macb)

{dissect_target-3.20.dev12 → dissect_target-3.20.dev14}/dissect/target/plugins/os/unix/bsd/osx/_os.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 import plistlib
 from typing import Iterator, Optional
 
+from flow.record.fieldtypes import posix_path
+
 from dissect.target.filesystem import Filesystem
 from dissect.target.helpers.record import UnixUserRecord
 from dissect.target.plugin import OperatingSystem, export
@@ -71,7 +73,7 @@ class MacPlugin(BsdPlugin):
                         uid=user.get("uid", [None])[0],
                         gid=user.get("gid", [None])[0],
                         gecos=user.get("realname", [None])[0],
-                        home=home_dir,
+                        home=posix_path(home_dir) if home_dir else None,
                         shell=user.get("shell", [None])[0],
                         source=path,
                     )

{dissect_target-3.20.dev12 → dissect_target-3.20.dev14/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev12
+Version: 3.20.dev14
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev12 → dissect_target-3.20.dev14}/tests/plugins/filesystem/ntfs/test_mft.py

@@ -183,16 +183,28 @@ def test_mft_plugin_macb(target_win: Target) -> None:
     path = None
     ts = None
     macb = None
-    field = "MACB/MACB/MACB"
+    field = "MACB/MACB"
     for record in mft_data:
         assert record.macb != macb or record.ts != ts or record.path != path
-        for bit in [0, 1, 2, 3, 5, 6, 7, 9, 10, 11, 12]:
+        for bit in [0, 1, 2, 3, 5, 6, 7]:
             assert record.macb[bit : bit + 1] in (field[bit : bit + 1], ".")
         path = record.path
         macb = record.macb
         ts = record.ts
 
 
+def test_mft_plugin_macb_ads(target_win: Target) -> None:
+    load_mft_plugin(target_win)
+    mft_data = list(target_win.mft(macb=True))
+    ads_entries = 0
+    for record in mft_data:
+        if record.ads:
+            ads_entries += 1
+            assert record.macb.endswith("/....")
+            assert not record.macb.startswith("..../")
+    assert ads_entries == 6
+
+
 def test_mft_plugin_macb_nodup() -> None:
     # test whether you can never have duplicates
 

{dissect_target-3.20.dev12 → dissect_target-3.20.dev14}/tests/plugins/os/unix/bsd/osx/test__os.py

@@ -1,3 +1,5 @@
+from flow.record.fieldtypes import posix_path
+
 from dissect.target.plugins.os.unix.bsd.osx._os import MacPlugin
 from tests._utils import absolute_path
 
@@ -26,6 +28,7 @@ def test_unix_bsd_osx_os(target_osx_users, fs_osx):
     assert dissect_user.name == "_dissect"
     assert dissect_user.passwd == "*"
     assert dissect_user.home == "/var/empty"
+    assert isinstance(dissect_user.home, posix_path)
     assert dissect_user.shell == "/usr/bin/false"
     assert dissect_user.source == "/var/db/dslocal/nodes/Default/users/_dissect.plist"