Test Functions

ADARE provides a comprehensive set of test functions to validate forensic artifacts and system states. This reference documents all available test functions organized by testsets.

Test Function Status Legend

• ● Tested: Fully implemented and tested in production

• ● Development: Implemented but under active development

• ● Planned: Planned for future implementation

Available Testsets

ADARE organizes test functions into logical testsets based on their purpose and functionality:

Testset	Functions	Description
Standard	11	File system operations, content validation, permissions, and metadata testing
JSON	3	JSON data validation, key existence checking, value comparison, and array element verification
CSV	1	CSV data validation and row pattern matching with regex and timestamp support
XML	6	XML data validation with XPath, namespace support, regex patterns, and timestamp tolerance
SQLite	1	SQLite database query execution and result validation
Linux	4	Linux system validation including services, processes, users, and logs
Windows	2	Windows system validation including registry key and value operations

Usage in Playbooks

Test functions are used in the tests section of ADARE playbooks:

tests:
  - name: check_file_exists
    function: file_exists
    parameter:
      dst: "/path/to/file.txt"
    description: "Verify the file was created"

  - name: check_content
    function: file_content_contains
    parameter:
      dst: "/path/to/logfile.log"
      content: "ERROR: Authentication failed"
    description: "Verify error was logged"

Overvies of all Test Functions

Function	S	Description	Parameters
standard.file_exists	●	Tests if a file exists at the specified path	dst (string)
standard.file_does_not_exist	●	Tests if a file does NOT exist at the specified path	dst (string)
standard.dir_exists	●	Tests if a directory exists at the specified path	dst (string)
standard.dir_does_not_exist	●	Tests if a directory does NOT exist at the specified path	dst (string)
standard.dir_content	●	Tests if a directory contains the expected files/folders	dst (string), files (list)
standard.file_content_matches_regex	●	Tests if file content matches a regular expression	dst (string), regex (string)
standard.file_content_equals	●	Tests if file content exactly equals the given content	dst (string), content (string)
standard.file_hash_matches	●	Tests if file hash matches expected value	dst (string), expected_hash (string), hash_type (string, optional)
standard.file_timestamps	●	Tests file timestamps with various comparison types	dst (string), timestamp_type (string, optional), comparison_type (string, optional), expected_time (string/number, optional)
standard.file_permissions	●	Tests file permissions owner and group	dst (string), expected_permissions (string), check_owner (string, optional), check_group (string, optional)
standard.file_content_contains	●	Tests if file content contains specified string or byte pattern	dst (string), content (string), content_type (string, optional)
json.contains_key	●	Tests if JSON file contains specified key path (supports dot notation like “user.profile.name”)	dst (string), key_path (string)
json.value_matches	●	Tests if JSON value at key path matches expected value using placeholders (supports wildcards [*] and * with any/all modes)	dst (string), key_path (string), expected_value (string/int/float/bool), regex_match (boolean, optional), wildcard_mode (string, optional)
json.array_contains	●	Tests if JSON array at specified path contains expected element	dst (string), array_path (string), expected_element (string/int/float/bool/dict/list)
csv.contains_line	●	Tests if row in a CSV file exists that matches the given entry layout	dst (string), entry (list)
sqlite.query_result	●	Executes SQL query against SQLite database and validates result	dst (string), query (string), expected_rows* (integer), expected_result* (list)
linux.system_service_status	●	Tests if a systemd service has expected status (Linux only)	service_name (string), expected_status (string)
linux.process_running	●	Tests if a process is running with expected number of instances (Linux only)	process_name (string), min_instances* (integer)
linux.user_exists	●	Tests if a user account exists on the Linux system	username (string)
linux.log_entry_exists	●	Tests if a log file contains entries matching a specified pattern	log_file (string), pattern (string), max_lines* (integer)
windows.registry_key_exists	●	Tests if Windows registry key exists (Windows only)	key_path (string)
windows.registry_value_matches	●	Tests if Windows registry value matches expected value with type validation (Windows only)	key_path (string), value_name (string), expected_value (string/integer/bytes), value_type* (string)
xml.element_exists	●	Tests if XML element exists at specified XPath	dst (string), xpath (string), namespaces* (dict)
xml.element_text_matches	●	Tests if XML element text content matches expected value with placeholder support for regex and timestamp tolerance	dst (string), xpath (string), expected_text (string), regex_match* (boolean), case_sensitive* (boolean), wildcard_mode* (string), namespaces* (dict)
xml.attribute_matches	●	Tests if XML element attribute matches expected value with regex and timestamp tolerance support	dst (string), xpath (string), attribute_name (string), expected_value (string), regex_match* (boolean), case_sensitive* (boolean), namespaces* (dict)
xml.element_count	●	Tests the number of XML elements matching XPath expression	dst (string), xpath (string), expected_count (integer), comparison_type* (string), namespaces* (dict)
xml.xpath_result_matches	●	Tests if XPath expression result matches expected value (text/number/boolean)	dst (string), xpath (string), expected_result (string/int/float/bool), result_type* (string), namespaces* (dict)
xml.namespace_matches	●	Tests if XML namespace declarations match expected namespaces	dst (string), expected_namespaces (dict), check_mode* (string)

Note

● : Tested, ● : In Development, ● : Planned