diff --git a/esedbrc/data/known_databases.yaml b/esedbrc/data/known_databases.yaml index 04a2ac3..aa5abac 100644 --- a/esedbrc/data/known_databases.yaml +++ b/esedbrc/data/known_databases.yaml @@ -1,4 +1,19 @@ # esedb-kb database definitions --- +artifact_definition: InternetExplorerHistory +database_identifier: windows_WebCacheVXX.dat +--- +artifact_definition: WindowsBITSQueueManagerDatabases +database_identifier: windows_bits_qmgr.db +--- artifact_definition: WindowsCortanaDatabase database_identifier: windows_CortanaCoreDb.dat +--- +artifact_definition: WindowsSearchDatabase +database_identifier: windows_search_Windows.edb +--- +artifact_definition: WindowsSecuritySettingsDatabases +database_identifier: windows_secedit.sdb +--- +artifact_definition: WindowsSystemResourceUsageMonitorDatabaseFile +database_identifier: windows_SRUDB.dat diff --git a/esedbrc/schema_extractor.py b/esedbrc/schema_extractor.py index 3991734..517fe62 100644 --- a/esedbrc/schema_extractor.py +++ b/esedbrc/schema_extractor.py @@ -220,6 +220,8 @@ def _GetDatabaseSchemaFromFileObject(self, file_object): is_unique_table = False if is_unique_table: + # TODO: generalize name of unique tables e.g. change AppCacheEntryEx_9 + # into AppCacheEntryEx_# or AppCacheEntryEx_1 unique_table_definitions.append(table_definition) finally: diff --git a/tests/schema_extractor.py b/tests/schema_extractor.py index 85bdd4a..17aa9bc 100644 --- a/tests/schema_extractor.py +++ b/tests/schema_extractor.py @@ -66,9 +66,45 @@ def testFormatSchemaAsYAML(self): self.assertEqual(yaml_data, expected_yaml_data) - # TODO: add tests for _GetDatabaseSchema # TODO: add tests for _GetDatabaseIdentifier - # TODO: add tests for _GetDatabaseSchemaFromFileObject + + def testGetDatabaseSchema(self): + """Tests the _GetDatabaseSchema function.""" + test_extractor = schema_extractor.EseDbSchemaExtractor( + self._ARTIFACT_DEFINITIONS_PATH) + + database_path = self._GetTestFilePath(['WebCacheV01.dat']) + schema = test_extractor._GetDatabaseSchema(database_path) + + self.assertIsNotNone(schema) + self.assertEqual(len(schema), 10) + + table_definition = schema[0] + self.assertIsNotNone(table_definition) + self.assertEqual(len(table_definition.aliases), 1) + self.assertEqual(len(table_definition.column_definitions), 27) + self.assertEqual(table_definition.name, 'MSysObjects') + self.assertIsNone(table_definition.template_table_name) + + def testGetDatabaseSchemaFromFileObject(self): + """Tests the _GetDatabaseSchemaFromFileObject function.""" + test_extractor = schema_extractor.EseDbSchemaExtractor( + self._ARTIFACT_DEFINITIONS_PATH) + + database_path = self._GetTestFilePath(['WebCacheV01.dat']) + with open(database_path, 'rb') as file_object: + schema = test_extractor._GetDatabaseSchemaFromFileObject(file_object) + + self.assertIsNotNone(schema) + self.assertEqual(len(schema), 10) + + table_definition = schema[0] + self.assertIsNotNone(table_definition) + self.assertEqual(len(table_definition.aliases), 1) + self.assertEqual(len(table_definition.column_definitions), 27) + self.assertEqual(table_definition.name, 'MSysObjects') + self.assertIsNone(table_definition.template_table_name) + # TODO: add tests for GetDisplayPath # TODO: add tests for ExtractSchemas # TODO: add tests for FormatSchema