Enum AnomalyKind 

#[non_exhaustive]
pub enum AnomalyKind {
    ObjectChecksumMismatch {
        block: u64,
        stored: u64,
        computed: u64,
    },
    OmapInconsistent {
        oid: u64,
        xid: u64,
    },
    OmapOrphanMapping {
        oid: u64,
    },
    CheckpointRingMalformed {
        detail: &'static str,
    },
    CheckpointSupersededState {
        xid: u64,
    },
    SnapshotXidDisorder {
        xid: u64,
    },
    SnapshotMissingMetadata {
        name: String,
    },
    SnapshotDivergence {
        inode: u64,
    },
    SealedVolumeHashMismatch {
        inode: u64,
    },
    SealedVolumeBroken {
        broken_xid: u64,
    },
    DeletedInodeRecoverable {
        oid: u64,
    },
    DeletedExtentCarveCandidate {
        block: u64,
    },
    ReaperPendingObject {
        oid: u64,
    },
    CloneSharedExtent {
        inode_a: u64,
        inode_b: u64,
    },
    CloneFlagWithoutSharing {
        inode: u64,
    },
    EncryptionLocked,
    EncryptionState {
        detail: String,
    },
    EncryptionKeybagAnomaly {
        raw_tag: u8,
        offset: u64,
    },
    TimestampZeroed {
        inode: u64,
    },
    TimestampOrder {
        inode: u64,
    },
    XidReuse {
        oid: u64,
        xid: u64,
    },
    OrphanInode {
        oid: u64,
    },
    VolumeRoleMismatch {
        detail: String,
    },
}

The APFS-specific anomalies this analyzer can surface. Each variant maps to a published, scheme-prefixed SCREAMING-KEBAB code (never changed once shipped; new variants get new codes).

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

ObjectChecksumMismatch

APFS-OBJECT-CKSUM-MISMATCH — Fletcher-64 over an object body ≠ stored o_cksum. Carries the block, stored, and computed values.

Fields

block: u64

stored: u64

computed: u64

OmapInconsistent

APFS-OMAP-INCONSISTENT — omap maps a virtual oid to a paddr whose object oid/xid/type disagrees.

Fields

oid: u64

xid: u64

OmapOrphanMapping

APFS-OMAP-ORPHAN-MAPPING (Info) — omap entry for a block not referable from any live tree (FP-prone without a full reachability model).

Fields

oid: u64

CheckpointRingMalformed

APFS-CHECKPOINT-RING-MALFORMED — structurally invalid checkpoint ring (no cksum-valid NXSB, bad magic, wrap/index inconsistency).

Fields

detail: &'static str

CheckpointSupersededState

APFS-CHECKPOINT-SUPERSEDED-STATE (Info) — recoverable prior state in a non-latest checkpoint (normal copy-on-write residue).

Fields

xid: u64

SnapshotXidDisorder

APFS-SNAPSHOT-XID-DISORDER (Info) — snapshot xids inconsistent with create_time ordering.

Fields

xid: u64

SnapshotMissingMetadata

APFS-SNAPSHOT-MISSING-METADATA — snap-name without snap-metadata (or vice-versa).

Fields

name: String

SnapshotDivergence

APFS-SNAPSHOT-DIVERGENCE (Info) — a snapshot’s inode view differs from the live volume.

Fields

inode: u64

SealedVolumeHashMismatch

APFS-SEALED-VOLUME-HASH-MISMATCH — sealed-volume file-info hash ≠ recomputed content hash (a hash-metadata mismatch, not a trust verdict).

Fields

inode: u64

SealedVolumeBroken

APFS-SEALED-VOLUME-BROKEN — integrity_meta_phys.im_broken_xid set.

Fields

broken_xid: u64

DeletedInodeRecoverable

APFS-DELETED-INODE-RECOVERABLE — superseded inode/dir record still in an older checkpoint / unreaped block.

Fields

oid: u64

DeletedExtentCarveCandidate

APFS-DELETED-EXTENT-CARVE-CANDIDATE (Low) — extent blocks marked free (carve candidate, NOT a recoverability guarantee).

Fields

block: u64

ReaperPendingObject

APFS-REAPER-PENDING-OBJECT (Low) — object queued in the reaper.

Fields

oid: u64

CloneSharedExtent

APFS-CLONE-SHARED-EXTENT (Info) — inode shares physical extents (clonefile/dedup provenance link).

Fields

inode_a: u64

inode_b: u64

CloneFlagWithoutSharing

APFS-CLONE-FLAG-WITHOUT-SHARING (Low) — INODE_WAS_CLONED set but no shared extent found.

Fields

inode: u64

EncryptionLocked

APFS-ENCRYPTION-LOCKED (Info) — volume encrypted, no key available.

EncryptionState

APFS-ENCRYPTION-STATE (Info) — observed keybag/crypto-state fields (raw).

Fields

detail: String

EncryptionKeybagAnomaly

APFS-ENCRYPTION-KEYBAG-ANOMALY — malformed/unexpected keybag entry; carries the raw tag value + offset.

Fields

raw_tag: u8

offset: u64

TimestampZeroed

APFS-TIMESTAMP-ZEROED (Info) — one timestamp 0 while siblings are set.

Fields

inode: u64

TimestampOrder

APFS-TIMESTAMP-ORDER (Info) — change_time < create_time, etc. (FP-prone).

Fields

inode: u64

XidReuse

APFS-XID-REUSE — two live objects claim the same (oid, xid).

Fields

oid: u64

xid: u64

OrphanInode

APFS-ORPHAN-INODE (Low) — inode with no referencing DIR_REC.

Fields

oid: u64

VolumeRoleMismatch

APFS-VOLUME-ROLE-MISMATCH (Info) — volume role flag inconsistent with content.

Fields

detail: String

Implementations

impl AnomalyKind

pub fn code(&self) -> &'static str

The published anomaly code.

Trait Implementations

impl Clone for AnomalyKind

fn clone(&self) -> AnomalyKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AnomalyKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Observation for AnomalyKind

fn severity(&self) -> Option<Severity>

Severity, or None if the analyzer deliberately does not grade this kind.

fn code(&self) -> &'static str

Stable, scheme-prefixed machine code.

fn note(&self) -> String

Human-readable, consistent-with note.

fn category(&self) -> Category

Analytical lens; defaults to Category::from_code of Observation::code. Override when a code’s keyword classification is wrong.

fn subjects(&self) -> Vec<SubjectRef>

Non-disk subjects this kind is about (default: none).

fn evidence(&self) -> Vec<Evidence>

Backing evidence rows (default: none).

fn mitre(&self) -> &'static [&'static str]

MITRE ATT&CK technique ids this kind is consistent with (default: none).

fn confidence(&self) -> Option<Confidence>

Heuristic confidence, if inferential (default: none).

fn to_finding(&self, source: Source) -> Finding

Assemble the canonical Finding from this kind and its producing source.