Struct Aff4Reader 

pub struct Aff4Reader { /* private fields */ }

A read-only AFF4 disk image reader.

Implements Read and Seek over the virtual disk address space. Supports both direct aff4:ImageStream images and aff4:Map-backed images (e.g., Evimetry Base-Allocated and Base-ExabyteSparse).

Implementations

impl Aff4Reader

pub fn open(path: &Path) -> Result<Self, Aff4Error>

Open an AFF4 image file.

Open an AFF4 image from a file path. See Self::open_reader for the byte-source variant (read straight from an outer .zip, etc.).

Errors

Aff4Error if the file cannot be opened or is not a valid AFF4 image.

pub fn open_reader(backing: Box<dyn ReadSeekSend>) -> Result<Self, Aff4Error>

Reads information.turtle from the ZIP container to locate the primary data stream (either a direct aff4:ImageStream or an aff4:Map-backed image) and its geometry (size, chunk size, compression).

Errors

Aff4Error if backing is not a valid AFF4 container or its metadata cannot be parsed.

pub fn virtual_disk_size(&self) -> u64

Virtual disk size in bytes.

For Map-backed images this is the Map’s declared size, not the inner ImageStream’s physical data size.

pub fn image_stream_size(&self) -> u64

Decompressed length of the underlying aff4:ImageStream content.

This is the ImageStream’s own aff4:size, distinct from Self::virtual_disk_size (the map-expanded virtual disk). It is the number of bytes the ImageStream aff4:hash digests cover.

pub fn stored_image_hashes(&self) -> &[StoredHash]

Content digests declared on the ImageStream node (aff4:hash).

Each covers the decompressed ImageStream content (see Self::read_image_stream_content). Empty when the turtle declares none.

pub fn unreadable_regions(&self) -> Vec<(u64, u64)>

Virtual (offset, length) regions the acquisition could not read (aff4:UnreadableData map targets), in offset order.

Empty for a fully-imaged image or a direct (non-Map) ImageStream. These regions read back as the UNREADABLEDATA fill, so whole-disk integrity cannot be fully established over them.

pub fn read_image_stream_content( &mut self, sink: impl FnMut(&[u8]), ) -> Result<(), Aff4Error>

Stream the decompressed aff4:ImageStream content, in chunk order, to sink — the exact byte sequence the ImageStream aff4:hash digests cover.

Feeds at most Self::image_stream_size bytes (the final chunk is truncated to the declared size). Use this to recompute and verify the stored content hashes without materialising the whole stream.

Errors

Aff4Error if a chunk cannot be located or decompressed.

Trait Implementations

impl Debug for Aff4Reader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Read for Aff4Reader

fn read(&mut self, buf: &mut [u8]) -> Result<usize>

Pull some bytes from this source into the specified buffer, returning how many bytes were read.

fn read_vectored(&mut self, bufs: &mut [IoSliceMut<'_>]) -> Result<usize, Error>

Like read, except that it reads into a slice of buffers.

fn is_read_vectored(&self) -> bool

🔬This is a nightly-only experimental API. (can_vector)

Determines if this Reader has an efficient read_vectored implementation.

fn read_to_end(&mut self, buf: &mut Vec<u8>) -> Result<usize, Error>

Reads all bytes until EOF in this source, placing them into buf.

fn read_to_string(&mut self, buf: &mut String) -> Result<usize, Error>

Reads all bytes until EOF in this source, appending them to buf.

fn read_exact(&mut self, buf: &mut [u8]) -> Result<(), Error>

Reads the exact number of bytes required to fill buf.

fn read_buf(&mut self, buf: BorrowedCursor<'_, u8>) -> Result<(), Error>

🔬This is a nightly-only experimental API. (read_buf)

Pull some bytes from this source into the specified buffer.

fn read_buf_exact( &mut self, cursor: BorrowedCursor<'_, u8>, ) -> Result<(), Error>

🔬This is a nightly-only experimental API. (read_buf)

Reads the exact number of bytes required to fill cursor.

fn by_ref(&mut self) -> &mut Self

where Self: Sized,

Creates a “by reference” adapter for this instance of Read.

fn bytes(self) -> Bytes<Self>

where Self: Sized,

Transforms this Read instance to an Iterator over its bytes.

fn chain<R>(self, next: R) -> Chain<Self, R>

where R: Read, Self: Sized,

Creates an adapter which will chain this stream with another.

fn take(self, limit: u64) -> Take<Self>

where Self: Sized,

Creates an adapter which will read at most limit bytes from it.

fn read_array<const N: usize>(&mut self) -> Result<[u8; N], Error>

where Self: Sized,

🔬This is a nightly-only experimental API. (read_array)

Read and return a fixed array of bytes from this source.

fn read_le<T>(&mut self) -> Result<T, Error>

where T: FromEndianBytes, Self: Sized,

🔬This is a nightly-only experimental API. (read_le)

Read and return a type (e.g. an integer) in little-endian order.

fn read_be<T>(&mut self) -> Result<T, Error>

where T: FromEndianBytes, Self: Sized,

🔬This is a nightly-only experimental API. (read_le)

Read and return a type (e.g. an integer) in big-endian order.

impl Seek for Aff4Reader

fn seek(&mut self, pos: SeekFrom) -> Result<u64>

Seek to an offset, in bytes, in a stream.

fn rewind(&mut self) -> Result<(), Error>

Rewind to the beginning of a stream.

fn stream_len(&mut self) -> Result<u64, Error>

🔬This is a nightly-only experimental API. (seek_stream_len)

Returns the length of this stream (in bytes).

fn stream_position(&mut self) -> Result<u64, Error>

Returns the current seek position from the start of the stream.

fn seek_relative(&mut self, offset: i64) -> Result<(), Error>

Seeks relative to the current position.