Repository: google/turbinia (language: python)

Issue:
Write tests for EWF evidence type
We now have EWF support from https://github.com/google/turbinia/pull/1112, but we should also add some tests as well.  We should be able to use test disks from dfVFS for this: https://github.com/log2timeline/dfvfs/tree/main/test_data, and this is probably a good test to base it off of: https://github.com/google/turbinia/blob/6e1b042c57381f02de13507a910c69340ea4bb99/turbinia/processors/mount_local_test.py#L149


Discussion / hints:

Fix patch:
diff --git a/docker/worker/Dockerfile b/docker/worker/Dockerfile
index 0db6a2576..b07be92e0 100644
--- a/docker/worker/Dockerfile
+++ b/docker/worker/Dockerfile
@@ -42,6 +42,7 @@ RUN apt-get update && apt-get -y install \
     libfsapfs-tools \
     libluksde-tools \
     sleuthkit \
+    libewf-tools \
     && apt-get clean && rm -rf /var/cache/apt/* /var/lib/apt/lists/*
 
 # Add turbinia user to system and sudoers


Test patch:
diff --git a/docker/tests/Dockerfile b/docker/tests/Dockerfile
index 0acd57f58..f04090aa7 100644
--- a/docker/tests/Dockerfile
+++ b/docker/tests/Dockerfile
@@ -41,6 +41,7 @@ RUN apt-get update && apt-get -y install \
     bulk-extractor \
     docker-explorer-tools \
     sleuthkit \
+    libewf-tools \
     && apt-get clean && rm -rf /var/cache/apt/* /var/lib/apt/lists/*
 
 # Add turbinia user to system and sudoers
diff --git a/test_data/ext2.E01 b/test_data/ext2.E01
new file mode 100644
index 000000000..d59a90a10
Binary files /dev/null and b/test_data/ext2.E01 differ
diff --git a/turbinia/processors/mount_local_test.py b/turbinia/processors/mount_local_test.py
index 14aada444..f6fb91970 100644
--- a/turbinia/processors/mount_local_test.py
+++ b/turbinia/processors/mount_local_test.py
@@ -280,6 +280,50 @@ def testPreprocessLosetup(self, mock_subprocess, mock_config):
     with self.assertRaises(TurbiniaException):
       mount_local.PreprocessLosetup(source_path)
 
+  @mock.patch('turbinia.processors.mount_local.config')
+  @mock.patch('tempfile.mkdtemp')
+  @mock.patch('subprocess.check_call')
+  @mock.patch('os.path.isdir')
+  @mock.patch('os.path.exists')
+  @mock.patch('os.makedirs')
+  def testPreprocessMountEwfDisk(
+      self, _, mock_path_exists, mock_path_isdir, mock_subprocess, mock_mkdtemp,
+      mock_config):
+    """Test PreprocessMountEwfDisk method."""
+    mock_config.MOUNT_DIR_PREFIX = '/mnt/turbinia'
+    mock_path_exists.side_effect = _mock_bitlocker_returns
+    mock_mkdtemp.return_value = '/mnt/turbinia/turbinia0ckdntz0'
+
+    current_path = os.path.abspath(os.path.dirname(__file__))
+    source_path = os.path.join(
+        current_path, '..', '..', 'test_data', 'ext2.E01')
+
+    # Test ewfmount
+    mock_path_isdir.return_value = True
+    device = mount_local.PreprocessMountEwfDisk(source_path)
+    expected_args = [
+        'sudo', 'ewfmount', '-X', 'allow_other', source_path,
+        '/mnt/turbinia/turbinia0ckdntz0'
+    ]
+    mock_subprocess.assert_called_once_with(expected_args)
+    self.assertEqual(device, '/mnt/turbinia/turbinia0ckdntz0')
+
+    # Test if source does not exist
+    with self.assertRaises(TurbiniaException):
+      mount_local.PreprocessMountEwfDisk('/dev/loop0p4')
+
+    # Test if mount path not directory
+    mock_path_isdir.return_value = False
+    with self.assertRaises(TurbiniaException):
+      mount_local.PreprocessMountEwfDisk(source_path)
+    mock_path_isdir.return_value = True
+
+    # Test ewfmount failure
+    mock_subprocess.reset_mock()
+    mock_subprocess.side_effect = CalledProcessError(1, 'ewfmount')
+    with self.assertRaises(TurbiniaException):
+      device = mount_local.PreprocessMountEwfDisk(source_path)
+
   @mock.patch('subprocess.check_output')
   @mock.patch('subprocess.check_call')
   def testPreprocessLVM(self, mock_subprocess, mock_output):