Fix test

Velocidex · Nov 20, 2024 · 0b96ca9 · 0b96ca9
1 parent c0d3a62
commit 0b96ca9
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/artifacts/testdata/server/testcases/ntfs.in.yaml b/artifacts/testdata/server/testcases/ntfs.in.yaml
@@ -21,7 +21,8 @@ Queries:
     WHERE OSPath =~ "document.txt:goodbye.txt"
 
   # Copy the MFT file out so we can parse it by itself.
-  - LET MFTFile <= tempfile()
+  - LET MFTDir <= tempdir()
+  - LET MFTFile <= MFTDir + "/test.mft"
   - LET _ <= copy(filename=pathspec(
          Path="$MFT",
          DelegateAccessor="file",

diff --git a/artifacts/testdata/server/testcases/ntfs.out.yaml b/artifacts/testdata/server/testcases/ntfs.out.yaml
@@ -37,7 +37,7 @@ LET NTFSInfoFromImage <= parse_ntfs( filename=srcDir+'/artifacts/testdata/files/
   "LastAccess0x30": "2018-09-24T07:55:29.7664719Z",
   "LogFileSeqNum": 1096672
  }
-]LET MFTFile <= tempfile()[]LET _ <= copy(filename=pathspec( Path="$MFT", DelegateAccessor="file", DelegatePath=srcDir+'/artifacts/testdata/files/test.ntfs.dd'), accessor="raw_ntfs", dest=MFTFile)[]SELECT EntryNumber, OSPath, parse_ntfs(mft_filename=MFTFile, mft=EntryNumber) AS Details FROM parse_mft(filename=MFTFile, start=45) LIMIT 10[
+]LET MFTDir <= tempdir()[]LET MFTFile <= MFTDir + "/test.mft"[]LET _ <= copy(filename=pathspec( Path="$MFT", DelegateAccessor="file", DelegatePath=srcDir+'/artifacts/testdata/files/test.ntfs.dd'), accessor="raw_ntfs", dest=MFTFile)[]SELECT EntryNumber, OSPath, parse_ntfs(mft_filename=MFTFile, mft=EntryNumber) AS Details FROM parse_mft(filename=MFTFile, start=45) LIMIT 10[
  {
   "EntryNumber": 45,
   "OSPath": "Folder A\\Folder B",