Add tests data related to containers (EWF, VDI, VHD, VHDX and VMDK)

pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     "dissect.cstruct>=4,<5",
     "dissect.database>=1.1.dev3,<2",  # TODO: update on release!
     "dissect.eventlog>=3,<4",
-    "dissect.evidence>=3.13.dev2,<4",  # TODO: update on release!
+    "dissect.evidence>=3.13.dev3,<4",  # TODO: update on release!
     "dissect.hypervisor>=3.20,<4",
     "dissect.ntfs>=3.16.dev,<4",
     "dissect.regf>=3.13,<4",

tests/containers/test_ewf.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+import os
+
+from dissect.target import container
+from dissect.target.containers.ewf import EwfContainer
+from tests._utils import absolute_path
+
+
+def test_ewf_container() -> None:
+    """Test that EWF containers are properly opened."""
+    path = absolute_path("_data/containers/ewf/small.E01")
+
+    fh = container.open(path)
+    assert isinstance(fh, EwfContainer)
+    a = fh.read(20)
+    assert a == b"testdissecte01\n"
+    assert fh.tell() == 15
+    fh.seek(0, whence=os.SEEK_SET)
+    assert fh.read(20) == b"testdissecte01\n"
+    fh.close()
+
+
+def test_ewf_container_splitted() -> None:
+    """Test that EWF containers are properly opened when container is split among multiple files"""
+    path = absolute_path("_data/containers/ewf/splitted.E01")
+
+    fh = container.open(path)
+    assert isinstance(fh, EwfContainer)
+    assert fh.read(20) == b"\x90g`\x023H\xd2_\x18\x9cj\xb7G\x80\x8c\xf1\r\x7f\x80\xda"
+    fh.seek(0, whence=os.SEEK_END)
+    assert fh.tell() == 1075200
+    fh.seek(-15, whence=os.SEEK_CUR)
+    assert fh.read(20) == b"CZ_\xbe\xc0\xf5\xfb\xf2\x7f/a\xd6\xb5w="
+    fh.close()

tests/containers/test_qcow2.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+import os
+
+from dissect.target import container
+from dissect.target.containers.qcow2 import QCow2Container
+from tests._utils import absolute_path
+
+
+def test_qcow2_container() -> None:
+    """Test that QCOW2 containers are properly opened."""
+    path = absolute_path("_data/containers/qcow2/small.qcow2")
+
+    fh = container.open(path)
+    assert isinstance(fh, QCow2Container)
+    a = fh.read(20)
+    # trailing \x00 are expected. This is the same when using qemu-nbd
+    assert a == b"testdissecteqcow2\n\x00\x00"
+    assert fh.tell() == 20
+    fh.seek(0, whence=os.SEEK_SET)
+    assert fh.read(20) == b"testdissecteqcow2\n\x00\x00"
+    fh.close()

tests/containers/test_split.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import os
 from io import BytesIO
 from typing import TYPE_CHECKING, BinaryIO
 
@@ -14,7 +15,6 @@
 
 def _assert_split_container(fh: SplitContainer) -> None:
     assert isinstance(fh, SplitContainer)
-    assert fh.read(4096) == (b"A" * 512) + (b"B" * 512) + (b"C" * 512) + (b"D" * 512)
 
 
 @pytest.fixture
@@ -54,3 +54,11 @@ def split_symlink(tmp_path: Path, split_paths: list[Path]) -> Path:
 def test_split_container(obj: str, request: pytest.FixtureRequest) -> None:
     fh = container.open(request.getfixturevalue(obj))
     _assert_split_container(fh)
+    assert fh.read(4096) == (b"A" * 512) + (b"B" * 512) + (b"C" * 512) + (b"D" * 512)
+    fh.seek(0, whence=os.SEEK_SET)
+    assert fh.read(4) == b"AAAA"
+    assert fh.tell() == 4
+    fh.seek(508, whence=os.SEEK_CUR)
+    assert fh.read(4) == b"BBBB"
+    fh.seek(-4, whence=os.SEEK_END)
+    assert fh.read(4) == b"DDDD"

tests/containers/test_vdi.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+import gzip
+import os
+
+from dissect.target import container
+from dissect.target.containers.vdi import VdiContainer
+from tests._utils import absolute_path
+
+
+def test_vdi_container() -> None:
+    """Test that VDI containers are properly opened."""
+    path = absolute_path("_data/containers/vdi/small.vdi.gz")
+    gz_file = gzip.GzipFile(path)
+    fh = container.open(gz_file)
+    assert isinstance(fh, VdiContainer)
+    a = fh.read(20)
+    assert a == b"\x00" * 20
+    assert fh.tell() == 20
+    fh.seek(0, whence=os.SEEK_END)
+    assert fh.tell() == 4194304
+    fh.close()
+    gz_file.close()

tests/containers/test_vhd.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+import gzip
+import os
+
+from dissect.target import container
+from dissect.target.containers.vhd import VhdContainer
+from tests._utils import absolute_path
+
+
+def test_vhd_container() -> None:
+    """Test that VHD containers are properly opened."""
+    path = absolute_path("_data/containers/vhd/small.vhd.gz")
+    gz_file = gzip.GzipFile(path)
+    fh = container.open(gz_file)
+    assert isinstance(fh, VhdContainer)
+    a = fh.read(20)
+    assert a == b"\x00" * 20
+    assert fh.tell() == 20
+    fh.seek(0, whence=os.SEEK_END)
+    assert fh.tell() == 4194304
+    fh.close()
+    gz_file.close()

tests/containers/test_vhdx.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+import gzip
+import os
+
+from dissect.target import container
+from dissect.target.containers.vhdx import VhdxContainer
+from tests._utils import absolute_path
+
+
+def test_vhdx_container() -> None:
+    """Test that VHDX containers are properly opened."""
+    path = absolute_path("_data/containers/vhdx/small.vhdx.gz")
+    gz_file = gzip.GzipFile(path)
+    fh = container.open(gz_file)
+    assert isinstance(fh, VhdxContainer)
+    a = fh.read(20)
+    assert a == b"\x00" * 20
+    assert fh.tell() == 20
+    fh.seek(0, whence=os.SEEK_END)
+    assert fh.tell() == 4194304
+    fh.close()
+    gz_file.close()

tests/containers/test_vmdk.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+import gzip
+import os
+
+from dissect.target import container
+from dissect.target.containers.vmdk import VmdkContainer
+from tests._utils import absolute_path
+
+
+def test_vmdk_container() -> None:
+    """Test that VMDK containers are properly opened."""
+    path = absolute_path("_data/containers/vmdk/small.vmdk.gz")
+    gz_file = gzip.GzipFile(path)
+    fh = container.open(gz_file)
+    assert isinstance(fh, VmdkContainer)
+    a = fh.read(20)
+    assert a == b"\x00" * 20
+    assert fh.tell() == 20
+    fh.seek(0, whence=os.SEEK_END)
+    assert fh.tell() == 4194304
+    fh.close()
+    gz_file.close()