Code review: 241430043: Added support for VSS display names #218

config/dpkg/changelog

@@ -2,4 +2,4 @@ python-plaso (1.3.0-1) unstable; urgency=low
 
   * Auto-generated
 
- -- Log2Timeline <[email protected]>  Sat, 13 Jun 2015 20:51:32 -0700
+ -- Log2Timeline <[email protected]>  Mon, 15 Jun 2015 13:52:02 +0200

plaso/__init__.py

@@ -3,7 +3,7 @@
 __version__ = '1.3.0'
 
 VERSION_DEV = True
-VERSION_DATE = '20150613'
+VERSION_DATE = '20150615'
 
 
 def GetVersion():

plaso/cli/storage_media_tool.py

@@ -465,7 +465,7 @@ def _PromptUserForVSSStoreIdentifiers(
       if print_header:
         self._output_writer.Write(
             u'The following Volume Shadow Snapshots (VSS) were found:\n'
-            u'Identifier\tVSS store identifier\tCreation Time\n')
+            u'Identifier\tVSS store identifier\t\t\tCreation Time\n')
 
         for volume_identifier in volume_identifiers:
           volume = volume_system.GetVolumeByIdentifier(volume_identifier)

plaso/parsers/mediator.py

@@ -170,6 +170,13 @@ def GetDisplayName(self, file_entry=None):
     if not relative_path:
       return file_entry.path_spec.type_indicator
 
+    if path_spec.parent and path_spec.parent.type_indicator in [
+        dfvfs_definitions.TYPE_INDICATOR_VSHADOW]:
+      store_index = getattr(path_spec.parent, u'store_index', None)
+      if store_index is not None:
+        return u'VSS{0:d}:{1:s}:{2:s}'.format(
+            store_index + 1, file_entry.path_spec.type_indicator, relative_path)
+
     return u'{0:s}:{1:s}'.format(
         file_entry.path_spec.type_indicator, relative_path)
 

tests/parsers/mediator.py

@@ -46,6 +46,25 @@ def testGetDisplayName(self):
     expected_display_name = u'GZIP:{0:s}'.format(test_path)
     self.assertEqual(display_name, expected_display_name)
 
+    test_path = self._GetTestFilePath([u'vsstest.qcow2'])
+    os_path_spec = path_spec_factory.Factory.NewPathSpec(
+        definitions.TYPE_INDICATOR_OS, location=test_path)
+    qcow_path_spec = path_spec_factory.Factory.NewPathSpec(
+        definitions.TYPE_INDICATOR_QCOW, parent=os_path_spec)
+    vshadow_path_spec = path_spec_factory.Factory.NewPathSpec(
+        definitions.TYPE_INDICATOR_VSHADOW, location=u'/vss2', store_index=1,
+        parent=qcow_path_spec)
+    tsk_path_spec = path_spec_factory.Factory.NewPathSpec(
+        definitions.TYPE_INDICATOR_TSK, inode=35, location=u'/syslog.gz',
+        parent=vshadow_path_spec)
+
+    file_entry = path_spec_resolver.Resolver.OpenFileEntry(tsk_path_spec)
+
+    display_name = parsers_mediator.GetDisplayName(file_entry=file_entry)
+
+    expected_display_name = u'VSS2:TSK:/syslog.gz'
+    self.assertEqual(display_name, expected_display_name)
+
     # TODO: add test with relative path.
 
   # TODO: add more tests.