Crate aff4 

AFF4 (Advanced Forensic Format 4) read-only disk image reader.

AFF4 is a ZIP-based container format with RDF/Turtle metadata. Disk images are stored as chunked “bevies” (ZIP segments). This crate supports NullCompressor, DeflateCompressor, Snappy, and LZ4 frame compression.

Images may be direct aff4:ImageStreams or aff4:Map-backed, where a Map redirects virtual addresses to ImageStream regions, Zero-fill, or SymbolicStreamFF.

Structs

Aff4Reader

A read-only AFF4 disk image reader.

LogicalContainer

A read-only AFF4-Logical container: a collection of logical files.

LogicalEntry

One logical file in an AFF4-L container (an aff4:FileImage node).

StoredHash

A content digest declared on the ImageStream node (aff4:hash).

Enums

Aff4Error

Errors that can occur while opening or reading an AFF4 image.

ContainerKind

The kind of AFF4 container, determined from information.turtle without fully opening the image — cheap enough for filesystem detection.

Traits

ReadSeekSend

A seekable, thread-safe byte source the AFF4 container ZIP can sit on: a File, an in-RAM Cursor, or a positioned sub-range of an outer .zip. Lets a caller open an AFF4 image straight from a byte source (no temp-file extraction) via Aff4Reader::open_reader, while Aff4Reader::open keeps the file-path convenience.

Functions

container_kind

Classify an AFF4 container by reading its information.turtle once.

decrypt_encrypted_stream

Decrypt an encrypted AFF4 container with password, returning the plaintext of its aff4:EncryptedStream — an inner AFF4 volume.

decrypt_reader

Byte-source variant of decrypt_encrypted_stream.