dissect.target 3.20.dev23__tar.gz → 3.20.dev25__tar.gz

{dissect_target-3.20.dev23/dissect.target.egg-info → dissect_target-3.20.dev25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev23
+Version: 3.20.dev25
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev23 → dissect_target-3.20.dev25}/dissect/target/filesystems/btrfs.py

@@ -181,6 +181,9 @@ class BtrfsFilesystemEntry(FilesystemEntry):
 
         # Add block information of the filesystem
         st_info.st_blksize = entry.btrfs.sector_size
-        st_info.st_blocks = math.ceil(entry.size / st_info.st_blksize)
+
+        st_info.st_blocks = 0
+        if not self.is_dir():
+            st_info.st_blocks = (st_info.st_blksize // 512) * math.ceil(st_info.st_size / st_info.st_blksize)
 
         return st_info

{dissect_target-3.20.dev23 → dissect_target-3.20.dev25}/dissect/target/filesystems/ntfs.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import math
 import stat
 from typing import BinaryIO, Iterator, Optional
 
@@ -151,12 +152,14 @@ class NtfsFilesystemEntry(FilesystemEntry):
         record = self.dereference()
 
         size = 0
+        real_size = 0
         if self.is_symlink():
             mode = stat.S_IFLNK
         elif self.is_file():
             mode = stat.S_IFREG
             try:
                 size = record.size(self.ads)
+                real_size = record.size(self.ads, allocated=True)
             except NtfsFileNotFoundError as e:
                 # Occurs when it cannot find the the specific ads inside its attributes
                 raise FileNotFoundError from e
@@ -176,16 +179,29 @@ class NtfsFilesystemEntry(FilesystemEntry):
                 0,
                 size,
                 stdinfo.last_access_time.timestamp(),
-                stdinfo.last_change_time.timestamp(),
+                stdinfo.last_modification_time.timestamp(),
+                # ctime gets set to creation time for python <3.12 purposes
                 stdinfo.creation_time.timestamp(),
             ]
         )
 
         # Set the nanosecond resolution separately
         st_info.st_atime_ns = stdinfo.last_access_time_ns
-        st_info.st_mtime_ns = stdinfo.last_change_time_ns
+        st_info.st_mtime_ns = stdinfo.last_modification_time_ns
+
         st_info.st_ctime_ns = stdinfo.creation_time_ns
 
+        st_info.st_birthtime = stdinfo.creation_time.timestamp()
+        st_info.st_birthtime_ns = stdinfo.creation_time_ns
+
+        # real_size is none if the size is resident
+        st_info.st_blksize = record.ntfs.cluster_size
+        blocks = 0
+        if not record.resident:
+            blocks = math.ceil(real_size / 512)
+
+        st_info.st_blocks = blocks
+
         return st_info
 
     def attr(self) -> AttributeMap:

{dissect_target-3.20.dev23 → dissect_target-3.20.dev25/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev23
+Version: 3.20.dev25
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev23 → dissect_target-3.20.dev25}/tests/filesystems/test_btrfs.py

@@ -10,9 +10,9 @@ from dissect.target.filesystems.btrfs import BtrfsFilesystemEntry
 @pytest.mark.parametrize(
     "sector_size, filesize, expected_blocks",
     [
-        (0x1000, 0x343, 0x1),
-        (0x1000, 0x1000, 0x1),
-        (0x1000, 0x1001, 0x2),
+        (0x1000, 0x343, 0x8),
+        (0x1000, 0x1000, 0x8),
+        (0x1000, 0x1001, 0x10),
     ],
     ids=["lower", "equal", "greater"],
 )
@@ -55,3 +55,27 @@ def test_stat_information_file_blocksize(sector_size: int, filesize: int, expect
 
     assert stat_info.st_blksize == sector_size
     assert stat_info.st_blocks == expected_blocks
+
+
+def test_stat_directory() -> None:
+    """Using btrfs stat information as a base"""
+    entry = INode(Mock(), 42, type=c_btrfs.BTRFS_FT_DIR)
+    entry.btrfs = Mock(sector_size=0x1000)
+    timestamp = c_btrfs.btrfs_timespec()
+    entry.inode = c_btrfs.btrfs_inode_item(
+        mode=0o777,
+        nlink=0,
+        uid=1000,
+        gid=1000,
+        size=0x1000,
+        atime=timestamp,
+        ctime=timestamp,
+        otime=timestamp,
+        mtime=timestamp,
+    )
+
+    fs_entry = BtrfsFilesystemEntry(Mock(), "some/path", entry)
+
+    stat_info = fs_entry.lstat()
+
+    assert stat_info.st_blocks == 0

dissect_target-3.20.dev25/tests/filesystems/test_ntfs.py

@@ -0,0 +1,130 @@
+import io
+import math
+from unittest.mock import Mock, patch
+
+import pytest
+from dissect.ntfs.attr import Attribute, StandardInformation
+from dissect.ntfs.c_ntfs import c_ntfs
+from dissect.ntfs.exceptions import FileNotFoundError as NtfsFileNotFoundError
+from dissect.ntfs.mft import MftRecord
+from dissect.ntfs.util import AttributeMap
+
+from dissect.target.exceptions import FileNotFoundError
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.filesystems.ntfs import NtfsFilesystem, NtfsFilesystemEntry
+
+
+@pytest.mark.parametrize(
+    "path, expected_path, expected_ads",
+    [
+        ("test:data", "test", "data"),
+        ("test:$hello", "test", "$hello"),
+        ("test:$hello:$test", "test:$hello", "$test"),
+    ],
+)
+def test_ads_ntfs_filesystem(path: str, expected_path: str, expected_ads: str) -> None:
+    with patch("dissect.target.filesystems.ntfs.NTFS"):
+        filesystem = NtfsFilesystem()
+        entry = filesystem.get(path)
+
+        assert entry.ads == expected_ads
+        assert entry.path == expected_path
+        filesystem.ntfs.mft.get.assert_called_once_with(expected_path, root=None)
+
+
+@pytest.mark.parametrize(
+    "ads, name, output",
+    [
+        ("ads", "", "ads"),
+        ("ads", "test", "test"),
+    ],
+)
+def test_ntfs_fileentry_open(ads: str, name: str, output: str) -> None:
+    vfs = VirtualFilesystem()
+    mocked_entry = Mock()
+    mocked_entry.attributes = AttributeMap()
+    mocked_entry.is_dir.return_value = False
+    mocked_entry.is_symlink.return_value = False
+    mocked_entry.is_mount_point.return_value = False
+    entry = NtfsFilesystemEntry(vfs, "some/random/path", entry=mocked_entry)
+    entry.ads = ads
+    entry.open(name)
+
+    mocked_entry.open.assert_called_once_with(output)
+
+
+def test_ntfs_unknown_file() -> None:
+    vfs = VirtualFilesystem()
+    mocked_entry = Mock()
+    mocked_entry.attributes = AttributeMap()
+    mocked_entry.is_dir.return_value = False
+    mocked_entry.is_symlink.return_value = False
+    mocked_entry.is_mount_point.return_value = False
+    mocked_entry.size.side_effect = [NtfsFileNotFoundError]
+    entry = NtfsFilesystemEntry(vfs, "some/random/path", entry=mocked_entry)
+    with pytest.raises(FileNotFoundError):
+        entry.stat()
+
+
+@pytest.mark.parametrize(
+    "cluster_size, size, resident, expected_blks",
+    [
+        (0x1000, 0x343, False, 8),
+        (0x1000, 0x1001, False, 16),
+        (0x1000, 0, False, 0),
+        (0x1000, 0x2000, True, 0),
+    ],
+)
+def test_stat_information(cluster_size: int, size: int, resident: bool, expected_blks: int) -> None:
+    ntfs = Mock(cluster_size=cluster_size)
+
+    entry = MftRecord()
+    entry.header = c_ntfs._FILE_RECORD_SEGMENT_HEADER()
+    entry.ntfs = ntfs
+    entry.segment = 42
+
+    attribute_record = c_ntfs._ATTRIBUTE_RECORD_HEADER()
+    attribute_record.FormCode = 0 if resident else 1
+    if resident:
+        attribute_record.Form.Resident.ValueLength = size
+    else:
+        attribute_record.Form.Nonresident.FileSize = size
+        # Needs to be a multiple of cluster_size
+        attribute_record.Form.Nonresident.AllocatedLength = math.ceil(size / cluster_size) * cluster_size
+
+    map = AttributeMap()
+    map[0x10] = StandardInformation(
+        io.BytesIO(
+            b"\xb5\xc3S\xbb\xd1a\xd8\x01\xc1H\xedc$\x04\xdb\x01d \x0c\xb0v\xcc\xd9"
+            b"\x01\xc1H\xedc$\x04\xdb\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+            b"\x00\x00\x00\x00\x00\x00\x00\x00\x00%\x03\x00\x00\x00\x00\x00\x00\x00"
+            b"\x00\x00\x00\x00\x92h8\x00\x00\x00\x00"
+        )
+    )
+    map[0x80] = [Attribute.from_fh(io.BytesIO(attribute_record.dumps()))]
+
+    mock_fs = Mock()
+    with patch.object(entry, "attributes", map):
+        fs_entry = NtfsFilesystemEntry(mock_fs, "some/path", entry)
+
+        stat_info = fs_entry.lstat()
+
+        assert stat_info.st_mode == 33279
+        assert stat_info.st_ino == 42
+        assert stat_info.st_dev == id(mock_fs)
+        assert stat_info.st_nlink == 0
+        assert stat_info.st_uid == 0
+        assert stat_info.st_gid == 0
+        assert stat_info.st_size == size
+
+        assert stat_info.st_atime == 1726043227.939039
+        assert stat_info.st_atime_ns == 1726043227939040100
+        assert stat_info.st_mtime == 1726043227.939039
+        assert stat_info.st_mtime_ns == 1726043227939040100
+        assert stat_info.st_ctime == 1651900642.631773
+        assert stat_info.st_ctime_ns == 1651900642631774900
+        assert stat_info.st_birthtime == 1651900642.631773
+        assert stat_info.st_birthtime_ns == 1651900642631774900
+
+        assert stat_info.st_blksize == cluster_size
+        assert stat_info.st_blocks == expected_blks

dissect_target-3.20.dev23/tests/filesystems/test_ntfs.py

@@ -1,61 +0,0 @@
-from unittest.mock import Mock, patch
-
-import pytest
-from dissect.ntfs.exceptions import FileNotFoundError as NtfsFileNotFoundError
-from dissect.ntfs.util import AttributeMap
-
-from dissect.target.exceptions import FileNotFoundError
-from dissect.target.filesystem import VirtualFilesystem
-from dissect.target.filesystems.ntfs import NtfsFilesystem, NtfsFilesystemEntry
-
-
-@pytest.mark.parametrize(
-    "path, expected_path, expected_ads",
-    [
-        ("test:data", "test", "data"),
-        ("test:$hello", "test", "$hello"),
-        ("test:$hello:$test", "test:$hello", "$test"),
-    ],
-)
-def test_ads_ntfs_filesystem(path, expected_path, expected_ads):
-    with patch("dissect.target.filesystems.ntfs.NTFS"):
-        filesystem = NtfsFilesystem()
-        entry = filesystem.get(path)
-
-        assert entry.ads == expected_ads
-        assert entry.path == expected_path
-        filesystem.ntfs.mft.get.assert_called_once_with(expected_path, root=None)
-
-
-@pytest.mark.parametrize(
-    "ads, name, output",
-    [
-        ("ads", "", "ads"),
-        ("ads", "test", "test"),
-    ],
-)
-def test_ntfs_fileentry_open(ads, name, output):
-    vfs = VirtualFilesystem()
-    mocked_entry = Mock()
-    mocked_entry.attributes = AttributeMap()
-    mocked_entry.is_dir.return_value = False
-    mocked_entry.is_symlink.return_value = False
-    mocked_entry.is_mount_point.return_value = False
-    entry = NtfsFilesystemEntry(vfs, "some/random/path", entry=mocked_entry)
-    entry.ads = ads
-    entry.open(name)
-
-    mocked_entry.open.assert_called_once_with(output)
-
-
-def test_ntfs_unknown_file():
-    vfs = VirtualFilesystem()
-    mocked_entry = Mock()
-    mocked_entry.attributes = AttributeMap()
-    mocked_entry.is_dir.return_value = False
-    mocked_entry.is_symlink.return_value = False
-    mocked_entry.is_mount_point.return_value = False
-    mocked_entry.size.side_effect = [NtfsFileNotFoundError]
-    entry = NtfsFilesystemEntry(vfs, "some/random/path", entry=mocked_entry)
-    with pytest.raises(FileNotFoundError):
-        entry.stat()