Fix duplicate mounting for virtual NTFS (#1464)

Author: Politie-SOC

dissect/target/target.py

@@ -694,14 +694,22 @@ def _mount_others(self) -> None:
         counter = 0
         path = "/$fs$/fs0"
 
+        fake_ntfs = set()
         for fs in self.filesystems:
+            ntfs_obj = getattr(fs, "ntfs", None)
+            if ntfs_obj in fake_ntfs:
+                continue
             if fs not in root_fs.mounts.values():
                 # determine mount point
                 while root_fs.path(path).exists():
                     counter += 1
                     path = f"/$fs$/fs{counter}"
-
                 root_fs.mount(path, fs)
+            if ntfs_obj and fs.__type__ != "ntfs":
+                # A non ntfs filesystem with a "ntfs" object means that add_virtual_ntfs_filesystem was used.
+                # We use this ntfs object to identify the "fake" ntfs filesystem.
+                # This functions due to the fake ntfs object is added to the filesystem after its parent.
+                fake_ntfs.add(ntfs_obj)
 
     def add_plugin(
         self,

tests/loaders/test_kape.py

@@ -67,8 +67,8 @@ def test_dir(mock_kape_dir: Path) -> None:
 
     # The 3 found drive letter directories + the fake NTFS filesystem
     assert len(t.filesystems) == 4
-    # The 3 found drive letters + sysvol + the fake NTFS filesystem at /$fs$
-    assert len(t.fs.mounts) == 5
+    # The 3 found drive letters + sysvol
+    assert len(t.fs.mounts) == 4
     assert len(list(t.fs.mounts["c:"].ntfs.usnjrnl.records())) == 1
 
 

tests/loaders/test_tanium.py

@@ -64,6 +64,6 @@ def test_loader(mock_tanium_dir: Path) -> None:
 
     # The 3 found drive letter directories + the fake NTFS filesystem
     assert len(t.filesystems) == 4
-    # The 3 found drive letters + sysvol + the fake NTFS filesystem at /$fs$
-    assert len(t.fs.mounts) == 5
+    # The 3 found drive letters + sysvol
+    assert len(t.fs.mounts) == 4
     assert len(list(t.fs.mounts["c:"].ntfs.usnjrnl.records())) == 1

tests/test_target.py

@@ -224,6 +224,7 @@ def mocked_win_volumes_fs() -> Iterator[tuple[Mock, Mock, Mock]]:
     mock_good_volume.drive_letter = "W"
 
     mock_good_fs = Mock(name="good-fs")
+    mock_good_fs.__type__ = "mock"
     mock_good_fs.iter_subfs.return_value = []
 
     def mock_filesystem_open(volume: Mock) -> Mock:
@@ -581,7 +582,9 @@ def test_empty_volume_log(target_bare: Target, caplog: pytest.LogCaptureFixture)
 @pytest.mark.parametrize("nr_of_fs", [1, 2])
 def test_fs_mount_others(target_unix: Target, nr_of_fs: int) -> None:
     for _ in range(nr_of_fs):
-        target_unix.filesystems.add(Mock())
+        fs = Mock()
+        fs.__type__ = "mock"
+        target_unix.filesystems.add(fs)
 
     target_unix._mount_others()
 
@@ -595,7 +598,9 @@ def test_fs_mount_others(target_unix: Target, nr_of_fs: int) -> None:
 @pytest.mark.parametrize("nr_of_fs", [1, 2])
 def test_fs_mount_already_there(target_unix: Target, nr_of_fs: int) -> None:
     for idx in range(nr_of_fs):
-        target_unix.filesystems.add(Mock())
+        fs = Mock()
+        fs.__type__ = "mock"
+        target_unix.filesystems.add(fs)
         target_unix._mount_others()
 
         assert f"/$fs$/fs{idx}" in target_unix.fs.mounts