diff --git a/dissect/target/target.py b/dissect/target/target.py index 31c67d1430..87b83c366a 100644 --- a/dissect/target/target.py +++ b/dissect/target/target.py @@ -694,14 +694,22 @@ def _mount_others(self) -> None: counter = 0 path = "/$fs$/fs0" + fake_ntfs = set() for fs in self.filesystems: + ntfs_obj = getattr(fs, "ntfs", None) + if ntfs_obj in fake_ntfs: + continue if fs not in root_fs.mounts.values(): # determine mount point while root_fs.path(path).exists(): counter += 1 path = f"/$fs$/fs{counter}" - root_fs.mount(path, fs) + if ntfs_obj and fs.__type__ != "ntfs": + # A non ntfs filesystem with a "ntfs" object means that add_virtual_ntfs_filesystem was used. + # We use this ntfs object to identify the "fake" ntfs filesystem. + # This functions due to the fake ntfs object is added to the filesystem after its parent. + fake_ntfs.add(ntfs_obj) def add_plugin( self, diff --git a/tests/loaders/test_kape.py b/tests/loaders/test_kape.py index 8960db0f0f..b4128eb0da 100644 --- a/tests/loaders/test_kape.py +++ b/tests/loaders/test_kape.py @@ -67,8 +67,8 @@ def test_dir(mock_kape_dir: Path) -> None: # The 3 found drive letter directories + the fake NTFS filesystem assert len(t.filesystems) == 4 - # The 3 found drive letters + sysvol + the fake NTFS filesystem at /$fs$ - assert len(t.fs.mounts) == 5 + # The 3 found drive letters + sysvol + assert len(t.fs.mounts) == 4 assert len(list(t.fs.mounts["c:"].ntfs.usnjrnl.records())) == 1 diff --git a/tests/loaders/test_tanium.py b/tests/loaders/test_tanium.py index f382367720..1d529d7684 100644 --- a/tests/loaders/test_tanium.py +++ b/tests/loaders/test_tanium.py @@ -64,6 +64,6 @@ def test_loader(mock_tanium_dir: Path) -> None: # The 3 found drive letter directories + the fake NTFS filesystem assert len(t.filesystems) == 4 - # The 3 found drive letters + sysvol + the fake NTFS filesystem at /$fs$ - assert len(t.fs.mounts) == 5 + # The 3 found drive letters + sysvol + assert len(t.fs.mounts) == 4 assert len(list(t.fs.mounts["c:"].ntfs.usnjrnl.records())) == 1 diff --git a/tests/test_target.py b/tests/test_target.py index 52a6f8a895..b7a46bb112 100644 --- a/tests/test_target.py +++ b/tests/test_target.py @@ -224,6 +224,7 @@ def mocked_win_volumes_fs() -> Iterator[tuple[Mock, Mock, Mock]]: mock_good_volume.drive_letter = "W" mock_good_fs = Mock(name="good-fs") + mock_good_fs.__type__ = "mock" mock_good_fs.iter_subfs.return_value = [] def mock_filesystem_open(volume: Mock) -> Mock: @@ -581,7 +582,9 @@ def test_empty_volume_log(target_bare: Target, caplog: pytest.LogCaptureFixture) @pytest.mark.parametrize("nr_of_fs", [1, 2]) def test_fs_mount_others(target_unix: Target, nr_of_fs: int) -> None: for _ in range(nr_of_fs): - target_unix.filesystems.add(Mock()) + fs = Mock() + fs.__type__ = "mock" + target_unix.filesystems.add(fs) target_unix._mount_others() @@ -595,7 +598,9 @@ def test_fs_mount_others(target_unix: Target, nr_of_fs: int) -> None: @pytest.mark.parametrize("nr_of_fs", [1, 2]) def test_fs_mount_already_there(target_unix: Target, nr_of_fs: int) -> None: for idx in range(nr_of_fs): - target_unix.filesystems.add(Mock()) + fs = Mock() + fs.__type__ = "mock" + target_unix.filesystems.add(fs) target_unix._mount_others() assert f"/$fs$/fs{idx}" in target_unix.fs.mounts