Tests: Fix MFTScan testdata

These test values needed updating now that the `LayerData` type is used
and presents the data a little differently than before.

Author: dgmcdona

test/plugins/windows/windows.py

@@ -1,10 +1,10 @@
-import json
+import contextlib
 import hashlib
+import json
+import os
 import shutil
-import contextlib
 import tempfile
-import os
-from test import test_volatility, WindowsSamples
+from test import WindowsSamples, test_volatility
 
 
 class TestWindowsVolshell:
@@ -843,20 +843,22 @@ def test_windows_specific_mftscan_ads_xp(self, volatility, python):
             {
                 "ADS Filename": "Zone.Identifier",
                 "Filename": "libby_hoeler_part1.wmv",
-                "Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a                   ZoneId=3..      "',
+                "Hexdump": "5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a 5a 6f 6e 65 49 64 3d 33 0d 0a",
                 "MFT Type": "DATA",
                 "Offset": 55926304,
                 "Record Number": 323,
                 "Record Type": "FILE",
+                "__children": [],
             },
             {
                 "ADS Filename": "Zone.Identifier",
                 "Filename": "NetZeroQuickHelpLite.exe",
-                "Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a                   ZoneId=3..      "',
+                "Hexdump": "5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a 5a 6f 6e 65 49 64 3d 33 0d 0a",
                 "MFT Type": "DATA",
                 "Offset": 56102400,
                 "Record Number": 347,
                 "Record Type": "FILE",
+                "__children": [],
             },
         ]
         for expected_row in expected_rows:
@@ -877,20 +879,22 @@ def test_windows_specific_mftscan_ads_win10(self, volatility, python):
             {
                 "ADS Filename": "$Max",
                 "Filename": "$UsnJrnl",
-                "Hexdump": '"\n00 00 00 02 00 00 00 00 00 00 80 00 00 00 00 00 ................\nb9 dd f0 cc df 73 db 01 00 00 00 00 00 00 00 00 .....s.........."',
+                "Hexdump": "00 00 00 02 00 00 00 00 00 00 80 00 00 00 00 00 b9 dd f0 cc df 73 db 01 00 00 00 00 00 00 00 00",
                 "MFT Type": "DATA",
-                "Offset": 1058018088,
+                "Offset": 26235616,
                 "Record Number": 107240,
                 "Record Type": "FILE",
+                "__children": [],
             },
             {
-                "ADS Filename": "$Config",
-                "Filename": "$Repair",
-                "Hexdump": '"\n01 00 00 00 03 00 00 00                         ........        "',
+                "ADS Filename": "$SRAT",
+                "Filename": "$Bitmap",
+                "Hexdump": "a4 5f fd 60 38 00 01 03 10 00 0c 00 04 00 00 00 01 00 00 00 01 00 00 00 8d 4e 16 00 02 00 00 00 a0 00 00 00 00 00 06 00 03 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4a 7b 01 00 00 00 00 00",
                 "MFT Type": "DATA",
-                "Offset": 5009678688,
-                "Record Number": 28,
+                "Offset": 1052277088,
+                "Record Number": 6,
                 "Record Type": "FILE",
+                "__children": [],
             },
         ]
         for expected_row in expected_rows:
@@ -924,15 +928,15 @@ def test_windows_specific_mftscan_residentdata_win10(self, volatility, python):
         expected_rows = [
             {
                 "Filename": "index",
-                "Hexdump": '"\n30 5c 72 a7 1b 6d fb fc 09 00 00 00 00 00 00 00 0\\r..m..........\n00 00 00 00 00 00 00 00                         ........        "',
+                "Hexdump": "30 5c 72 a7 1b 6d fb fc 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
                 "MFT Type": "DATA",
                 "Offset": 4961536280,
                 "Record Number": 116474,
                 "Record Type": "FILE",
             },
             {
                 "Filename": "0.2.filtertrie.intermediate.txt",
-                "Hexdump": '"\n30 09 32 0d 0a                                  0.2..           "',
+                "Hexdump": "30 09 32 0d 0a",
                 "MFT Type": "DATA",
                 "Offset": 619242944,
                 "Record Number": 113013,
@@ -1411,4 +1415,3 @@ def test_windows_specific_virtmap(self, volatility, python):
         )
         for expected_row in expected_rows:
             assert test_volatility.match_output_row(expected_row, json_out)
-