diff --git a/config/dpkg/changelog b/config/dpkg/changelog index c9f895e67d..d482432ca3 100644 --- a/config/dpkg/changelog +++ b/config/dpkg/changelog @@ -2,4 +2,4 @@ python-plaso (1.3.0-1) unstable; urgency=low * Auto-generated - -- Log2Timeline Sat, 13 Jun 2015 20:51:32 -0700 + -- Log2Timeline Mon, 15 Jun 2015 13:52:02 +0200 diff --git a/plaso/__init__.py b/plaso/__init__.py index 217c2a0084..59d9b5c5e0 100644 --- a/plaso/__init__.py +++ b/plaso/__init__.py @@ -3,7 +3,7 @@ __version__ = '1.3.0' VERSION_DEV = True -VERSION_DATE = '20150613' +VERSION_DATE = '20150615' def GetVersion(): diff --git a/plaso/cli/storage_media_tool.py b/plaso/cli/storage_media_tool.py index 405c9f3dba..0b6487e673 100644 --- a/plaso/cli/storage_media_tool.py +++ b/plaso/cli/storage_media_tool.py @@ -465,7 +465,7 @@ def _PromptUserForVSSStoreIdentifiers( if print_header: self._output_writer.Write( u'The following Volume Shadow Snapshots (VSS) were found:\n' - u'Identifier\tVSS store identifier\tCreation Time\n') + u'Identifier\tVSS store identifier\t\t\tCreation Time\n') for volume_identifier in volume_identifiers: volume = volume_system.GetVolumeByIdentifier(volume_identifier) diff --git a/plaso/parsers/mediator.py b/plaso/parsers/mediator.py index 18501bfcc3..05da5e49d1 100644 --- a/plaso/parsers/mediator.py +++ b/plaso/parsers/mediator.py @@ -170,6 +170,13 @@ def GetDisplayName(self, file_entry=None): if not relative_path: return file_entry.path_spec.type_indicator + if path_spec.parent and path_spec.parent.type_indicator in [ + dfvfs_definitions.TYPE_INDICATOR_VSHADOW]: + store_index = getattr(path_spec.parent, u'store_index', None) + if store_index is not None: + return u'VSS{0:d}:{1:s}:{2:s}'.format( + store_index + 1, file_entry.path_spec.type_indicator, relative_path) + return u'{0:s}:{1:s}'.format( file_entry.path_spec.type_indicator, relative_path) diff --git a/tests/parsers/mediator.py b/tests/parsers/mediator.py index 0fd97a697d..6a6c725a61 100644 --- a/tests/parsers/mediator.py +++ b/tests/parsers/mediator.py @@ -46,6 +46,25 @@ def testGetDisplayName(self): expected_display_name = u'GZIP:{0:s}'.format(test_path) self.assertEqual(display_name, expected_display_name) + test_path = self._GetTestFilePath([u'vsstest.qcow2']) + os_path_spec = path_spec_factory.Factory.NewPathSpec( + definitions.TYPE_INDICATOR_OS, location=test_path) + qcow_path_spec = path_spec_factory.Factory.NewPathSpec( + definitions.TYPE_INDICATOR_QCOW, parent=os_path_spec) + vshadow_path_spec = path_spec_factory.Factory.NewPathSpec( + definitions.TYPE_INDICATOR_VSHADOW, location=u'/vss2', store_index=1, + parent=qcow_path_spec) + tsk_path_spec = path_spec_factory.Factory.NewPathSpec( + definitions.TYPE_INDICATOR_TSK, inode=35, location=u'/syslog.gz', + parent=vshadow_path_spec) + + file_entry = path_spec_resolver.Resolver.OpenFileEntry(tsk_path_spec) + + display_name = parsers_mediator.GetDisplayName(file_entry=file_entry) + + expected_display_name = u'VSS2:TSK:/syslog.gz' + self.assertEqual(display_name, expected_display_name) + # TODO: add test with relative path. # TODO: add more tests.