Struct Artifact 

pub struct Artifact { /* private fields */ }

Recovered non-script artifact view.

Implementations

impl Artifact

pub const fn record_index(&self) -> usize

Returns the source record index.

Returns

The index of the Record this artifact was recovered from.

Examples found in repository

examples/dump.rs (line 270)

fn print_artifacts(artifacts: &[Artifact]) {
    section(&format!("artifacts ({})", artifacts.len()));
    for artifact in artifacts {
        println!(
            "  record #{} {}",
            artifact.record_index(),
            escape_inline(artifact.name())
        );
        subfield("subtype", escape_inline(artifact.subtype()));
        subfield("bytes", artifact.bytes().len().to_string());
        subfield(
            "timestamps",
            format!(
                "created={} last_write={}",
                artifact.creation_time(),
                artifact.last_write_time()
            ),
        );
        subfield("checksum valid", artifact.checksum_valid().to_string());
        subfield(
            "decompression",
            format!("{:?}", artifact.decompression_status()),
        );
    }
}

pub fn subtype(&self) -> &str

Returns the record subtype.

Returns

The decoded subtype string of the source record.

Examples found in repository

examples/dump.rs (line 273)

fn print_artifacts(artifacts: &[Artifact]) {
    section(&format!("artifacts ({})", artifacts.len()));
    for artifact in artifacts {
        println!(
            "  record #{} {}",
            artifact.record_index(),
            escape_inline(artifact.name())
        );
        subfield("subtype", escape_inline(artifact.subtype()));
        subfield("bytes", artifact.bytes().len().to_string());
        subfield(
            "timestamps",
            format!(
                "created={} last_write={}",
                artifact.creation_time(),
                artifact.last_write_time()
            ),
        );
        subfield("checksum valid", artifact.checksum_valid().to_string());
        subfield(
            "decompression",
            format!("{:?}", artifact.decompression_status()),
        );
    }
}

pub fn name(&self) -> &str

Returns the stored record name/path.

Returns

The decoded name/path string of the source record.

Examples found in repository

examples/dump.rs (line 271)

fn print_artifacts(artifacts: &[Artifact]) {
    section(&format!("artifacts ({})", artifacts.len()));
    for artifact in artifacts {
        println!(
            "  record #{} {}",
            artifact.record_index(),
            escape_inline(artifact.name())
        );
        subfield("subtype", escape_inline(artifact.subtype()));
        subfield("bytes", artifact.bytes().len().to_string());
        subfield(
            "timestamps",
            format!(
                "created={} last_write={}",
                artifact.creation_time(),
                artifact.last_write_time()
            ),
        );
        subfield("checksum valid", artifact.checksum_valid().to_string());
        subfield(
            "decompression",
            format!("{:?}", artifact.decompression_status()),
        );
    }
}

pub fn bytes(&self) -> &[u8]

Returns recovered artifact bytes.

Returns

The best available payload bytes for the source record.

Examples found in repository

examples/dump.rs (line 274)

fn print_artifacts(artifacts: &[Artifact]) {
    section(&format!("artifacts ({})", artifacts.len()));
    for artifact in artifacts {
        println!(
            "  record #{} {}",
            artifact.record_index(),
            escape_inline(artifact.name())
        );
        subfield("subtype", escape_inline(artifact.subtype()));
        subfield("bytes", artifact.bytes().len().to_string());
        subfield(
            "timestamps",
            format!(
                "created={} last_write={}",
                artifact.creation_time(),
                artifact.last_write_time()
            ),
        );
        subfield("checksum valid", artifact.checksum_valid().to_string());
        subfield(
            "decompression",
            format!("{:?}", artifact.decompression_status()),
        );
    }
}

pub const fn creation_time(&self) -> u64

Returns creation timestamp as raw Windows FILETIME.

Returns

The raw 64-bit Windows FILETIME creation timestamp from the source record.

Examples found in repository

examples/dump.rs (line 279)

fn print_artifacts(artifacts: &[Artifact]) {
    section(&format!("artifacts ({})", artifacts.len()));
    for artifact in artifacts {
        println!(
            "  record #{} {}",
            artifact.record_index(),
            escape_inline(artifact.name())
        );
        subfield("subtype", escape_inline(artifact.subtype()));
        subfield("bytes", artifact.bytes().len().to_string());
        subfield(
            "timestamps",
            format!(
                "created={} last_write={}",
                artifact.creation_time(),
                artifact.last_write_time()
            ),
        );
        subfield("checksum valid", artifact.checksum_valid().to_string());
        subfield(
            "decompression",
            format!("{:?}", artifact.decompression_status()),
        );
    }
}

pub const fn last_write_time(&self) -> u64

Returns last-write timestamp as raw Windows FILETIME.

Returns

The raw 64-bit Windows FILETIME last-write timestamp from the source record.

Examples found in repository

examples/dump.rs (line 280)

fn print_artifacts(artifacts: &[Artifact]) {
    section(&format!("artifacts ({})", artifacts.len()));
    for artifact in artifacts {
        println!(
            "  record #{} {}",
            artifact.record_index(),
            escape_inline(artifact.name())
        );
        subfield("subtype", escape_inline(artifact.subtype()));
        subfield("bytes", artifact.bytes().len().to_string());
        subfield(
            "timestamps",
            format!(
                "created={} last_write={}",
                artifact.creation_time(),
                artifact.last_write_time()
            ),
        );
        subfield("checksum valid", artifact.checksum_valid().to_string());
        subfield(
            "decompression",
            format!("{:?}", artifact.decompression_status()),
        );
    }
}

pub const fn checksum_valid(&self) -> bool

Returns checksum validation status from the source record.

Returns

true if the source record’s stored checksum validated, false otherwise.

Examples found in repository

examples/dump.rs (line 283)

fn print_artifacts(artifacts: &[Artifact]) {
    section(&format!("artifacts ({})", artifacts.len()));
    for artifact in artifacts {
        println!(
            "  record #{} {}",
            artifact.record_index(),
            escape_inline(artifact.name())
        );
        subfield("subtype", escape_inline(artifact.subtype()));
        subfield("bytes", artifact.bytes().len().to_string());
        subfield(
            "timestamps",
            format!(
                "created={} last_write={}",
                artifact.creation_time(),
                artifact.last_write_time()
            ),
        );
        subfield("checksum valid", artifact.checksum_valid().to_string());
        subfield(
            "decompression",
            format!("{:?}", artifact.decompression_status()),
        );
    }
}

pub const fn decompression_status(&self) -> DecompressionStatus

Returns decompression status from the source record.

Returns

The DecompressionStatus recorded for the source record.

Examples found in repository

examples/dump.rs (line 286)

fn print_artifacts(artifacts: &[Artifact]) {
    section(&format!("artifacts ({})", artifacts.len()));
    for artifact in artifacts {
        println!(
            "  record #{} {}",
            artifact.record_index(),
            escape_inline(artifact.name())
        );
        subfield("subtype", escape_inline(artifact.subtype()));
        subfield("bytes", artifact.bytes().len().to_string());
        subfield(
            "timestamps",
            format!(
                "created={} last_write={}",
                artifact.creation_time(),
                artifact.last_write_time()
            ),
        );
        subfield("checksum valid", artifact.checksum_valid().to_string());
        subfield(
            "decompression",
            format!("{:?}", artifact.decompression_status()),
        );
    }
}

Trait Implementations

impl Clone for Artifact

fn clone(&self) -> Artifact

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Artifact

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Artifact

impl PartialEq for Artifact

fn eq(&self, other: &Artifact) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Artifact